2 * Algorithm testing framework and tests.
4 * Copyright (c) 2002 James Morris <jmorris@intercode.com.au>
5 * Copyright (c) 2002 Jean-Francois Dive <jef@linuxbe.org>
6 * Copyright (c) 2007 Nokia Siemens Networks
7 * Copyright (c) 2008 Herbert Xu <herbert@gondor.apana.org.au>
8 * Copyright (c) 2019 Google LLC
10 * Updated RFC4106 AES-GCM testing.
11 * Authors: Aidan O'Mahony (aidan.o.mahony@intel.com)
12 * Adrian Hoban <adrian.hoban@intel.com>
13 * Gabriele Paoloni <gabriele.paoloni@intel.com>
14 * Tadeusz Struk (tadeusz.struk@intel.com)
15 * Copyright (c) 2010, Intel Corporation.
17 * This program is free software; you can redistribute it and/or modify it
18 * under the terms of the GNU General Public License as published by the Free
19 * Software Foundation; either version 2 of the License, or (at your option)
24 #include <crypto/aead.h>
25 #include <crypto/hash.h>
26 #include <crypto/skcipher.h>
27 #include <linux/err.h>
28 #include <linux/fips.h>
29 #include <linux/module.h>
30 #include <linux/once.h>
31 #include <linux/random.h>
32 #include <linux/scatterlist.h>
33 #include <linux/slab.h>
34 #include <linux/string.h>
35 #include <crypto/rng.h>
36 #include <crypto/drbg.h>
37 #include <crypto/akcipher.h>
38 #include <crypto/kpp.h>
39 #include <crypto/acompress.h>
44 module_param(notests, bool, 0644);
45 MODULE_PARM_DESC(notests, "disable crypto self-tests");
47 #ifdef CONFIG_CRYPTO_MANAGER_EXTRA_TESTS
48 static bool noextratests;
49 module_param(noextratests, bool, 0644);
50 MODULE_PARM_DESC(noextratests, "disable expensive crypto self-tests");
52 static unsigned int fuzz_iterations = 100;
53 module_param(fuzz_iterations, uint, 0644);
54 MODULE_PARM_DESC(fuzz_iterations, "number of fuzz test iterations");
57 #ifdef CONFIG_CRYPTO_MANAGER_DISABLE_TESTS
60 int alg_test(const char *driver, const char *alg, u32 type, u32 mask)
70 * Need slab memory for testing (size in number of pages).
75 * Indexes into the xbuf to simulate cross-page access.
87 * Used by test_cipher()
92 struct aead_test_suite {
93 const struct aead_testvec *vecs;
97 struct cipher_test_suite {
98 const struct cipher_testvec *vecs;
102 struct comp_test_suite {
104 const struct comp_testvec *vecs;
109 struct hash_test_suite {
110 const struct hash_testvec *vecs;
114 struct cprng_test_suite {
115 const struct cprng_testvec *vecs;
119 struct drbg_test_suite {
120 const struct drbg_testvec *vecs;
124 struct akcipher_test_suite {
125 const struct akcipher_testvec *vecs;
129 struct kpp_test_suite {
130 const struct kpp_testvec *vecs;
134 struct alg_test_desc {
136 int (*test)(const struct alg_test_desc *desc, const char *driver,
138 int fips_allowed; /* set if alg is allowed in fips mode */
141 struct aead_test_suite aead;
142 struct cipher_test_suite cipher;
143 struct comp_test_suite comp;
144 struct hash_test_suite hash;
145 struct cprng_test_suite cprng;
146 struct drbg_test_suite drbg;
147 struct akcipher_test_suite akcipher;
148 struct kpp_test_suite kpp;
152 static const unsigned int IDX[8] = {
153 IDX1, IDX2, IDX3, IDX4, IDX5, IDX6, IDX7, IDX8 };
155 static void hexdump(unsigned char *buf, unsigned int len)
157 print_hex_dump(KERN_CONT, "", DUMP_PREFIX_OFFSET,
162 static int __testmgr_alloc_buf(char *buf[XBUFSIZE], int order)
166 for (i = 0; i < XBUFSIZE; i++) {
167 buf[i] = (char *)__get_free_pages(GFP_KERNEL, order);
176 free_pages((unsigned long)buf[i], order);
181 static int testmgr_alloc_buf(char *buf[XBUFSIZE])
183 return __testmgr_alloc_buf(buf, 0);
186 static void __testmgr_free_buf(char *buf[XBUFSIZE], int order)
190 for (i = 0; i < XBUFSIZE; i++)
191 free_pages((unsigned long)buf[i], order);
194 static void testmgr_free_buf(char *buf[XBUFSIZE])
196 __testmgr_free_buf(buf, 0);
199 #define TESTMGR_POISON_BYTE 0xfe
200 #define TESTMGR_POISON_LEN 16
202 static inline void testmgr_poison(void *addr, size_t len)
204 memset(addr, TESTMGR_POISON_BYTE, len);
207 /* Is the memory region still fully poisoned? */
208 static inline bool testmgr_is_poison(const void *addr, size_t len)
210 return memchr_inv(addr, TESTMGR_POISON_BYTE, len) == NULL;
213 /* flush type for hash algorithms */
215 /* merge with update of previous buffer(s) */
218 /* update with previous buffer(s) before doing this one */
221 /* likewise, but also export and re-import the intermediate state */
225 /* finalization function for hash algorithms */
226 enum finalization_type {
227 FINALIZATION_TYPE_FINAL, /* use final() */
228 FINALIZATION_TYPE_FINUP, /* use finup() */
229 FINALIZATION_TYPE_DIGEST, /* use digest() */
232 #define TEST_SG_TOTAL 10000
235 * struct test_sg_division - description of a scatterlist entry
237 * This struct describes one entry of a scatterlist being constructed to check a
238 * crypto test vector.
240 * @proportion_of_total: length of this chunk relative to the total length,
241 * given as a proportion out of TEST_SG_TOTAL so that it
242 * scales to fit any test vector
243 * @offset: byte offset into a 2-page buffer at which this chunk will start
244 * @offset_relative_to_alignmask: if true, add the algorithm's alignmask to the
246 * @flush_type: for hashes, whether an update() should be done now vs.
247 * continuing to accumulate data
249 struct test_sg_division {
250 unsigned int proportion_of_total;
252 bool offset_relative_to_alignmask;
253 enum flush_type flush_type;
257 * struct testvec_config - configuration for testing a crypto test vector
259 * This struct describes the data layout and other parameters with which each
260 * crypto test vector can be tested.
262 * @name: name of this config, logged for debugging purposes if a test fails
263 * @inplace: operate on the data in-place, if applicable for the algorithm type?
264 * @req_flags: extra request_flags, e.g. CRYPTO_TFM_REQ_MAY_SLEEP
265 * @src_divs: description of how to arrange the source scatterlist
266 * @dst_divs: description of how to arrange the dst scatterlist, if applicable
267 * for the algorithm type. Defaults to @src_divs if unset.
268 * @iv_offset: misalignment of the IV in the range [0..MAX_ALGAPI_ALIGNMASK+1],
269 * where 0 is aligned to a 2*(MAX_ALGAPI_ALIGNMASK+1) byte boundary
270 * @iv_offset_relative_to_alignmask: if true, add the algorithm's alignmask to
272 * @finalization_type: what finalization function to use for hashes
274 struct testvec_config {
278 struct test_sg_division src_divs[XBUFSIZE];
279 struct test_sg_division dst_divs[XBUFSIZE];
280 unsigned int iv_offset;
281 bool iv_offset_relative_to_alignmask;
282 enum finalization_type finalization_type;
285 #define TESTVEC_CONFIG_NAMELEN 192
288 * The following are the lists of testvec_configs to test for each algorithm
289 * type when the basic crypto self-tests are enabled, i.e. when
290 * CONFIG_CRYPTO_MANAGER_DISABLE_TESTS is unset. They aim to provide good test
291 * coverage, while keeping the test time much shorter than the full fuzz tests
292 * so that the basic tests can be enabled in a wider range of circumstances.
295 /* Configs for skciphers and aeads */
296 static const struct testvec_config default_cipher_testvec_configs[] = {
300 .src_divs = { { .proportion_of_total = 10000 } },
302 .name = "out-of-place",
303 .src_divs = { { .proportion_of_total = 10000 } },
305 .name = "unaligned buffer, offset=1",
306 .src_divs = { { .proportion_of_total = 10000, .offset = 1 } },
309 .name = "buffer aligned only to alignmask",
312 .proportion_of_total = 10000,
314 .offset_relative_to_alignmask = true,
318 .iv_offset_relative_to_alignmask = true,
320 .name = "two even aligned splits",
322 { .proportion_of_total = 5000 },
323 { .proportion_of_total = 5000 },
326 .name = "uneven misaligned splits, may sleep",
327 .req_flags = CRYPTO_TFM_REQ_MAY_SLEEP,
329 { .proportion_of_total = 1900, .offset = 33 },
330 { .proportion_of_total = 3300, .offset = 7 },
331 { .proportion_of_total = 4800, .offset = 18 },
335 .name = "misaligned splits crossing pages, inplace",
339 .proportion_of_total = 7500,
340 .offset = PAGE_SIZE - 32
342 .proportion_of_total = 2500,
343 .offset = PAGE_SIZE - 7
349 static unsigned int count_test_sg_divisions(const struct test_sg_division *divs)
351 unsigned int remaining = TEST_SG_TOTAL;
352 unsigned int ndivs = 0;
355 remaining -= divs[ndivs++].proportion_of_total;
361 static bool valid_sg_divisions(const struct test_sg_division *divs,
362 unsigned int count, bool *any_flushes_ret)
364 unsigned int total = 0;
367 for (i = 0; i < count && total != TEST_SG_TOTAL; i++) {
368 if (divs[i].proportion_of_total <= 0 ||
369 divs[i].proportion_of_total > TEST_SG_TOTAL - total)
371 total += divs[i].proportion_of_total;
372 if (divs[i].flush_type != FLUSH_TYPE_NONE)
373 *any_flushes_ret = true;
375 return total == TEST_SG_TOTAL &&
376 memchr_inv(&divs[i], 0, (count - i) * sizeof(divs[0])) == NULL;
380 * Check whether the given testvec_config is valid. This isn't strictly needed
381 * since every testvec_config should be valid, but check anyway so that people
382 * don't unknowingly add broken configs that don't do what they wanted.
384 static bool valid_testvec_config(const struct testvec_config *cfg)
386 bool any_flushes = false;
388 if (cfg->name == NULL)
391 if (!valid_sg_divisions(cfg->src_divs, ARRAY_SIZE(cfg->src_divs),
395 if (cfg->dst_divs[0].proportion_of_total) {
396 if (!valid_sg_divisions(cfg->dst_divs,
397 ARRAY_SIZE(cfg->dst_divs),
401 if (memchr_inv(cfg->dst_divs, 0, sizeof(cfg->dst_divs)))
403 /* defaults to dst_divs=src_divs */
407 (cfg->iv_offset_relative_to_alignmask ? MAX_ALGAPI_ALIGNMASK : 0) >
408 MAX_ALGAPI_ALIGNMASK + 1)
411 if (any_flushes && cfg->finalization_type == FINALIZATION_TYPE_DIGEST)
418 char *bufs[XBUFSIZE];
419 struct scatterlist sgl[XBUFSIZE];
420 struct scatterlist sgl_saved[XBUFSIZE];
421 struct scatterlist *sgl_ptr;
425 static int init_test_sglist(struct test_sglist *tsgl)
427 return __testmgr_alloc_buf(tsgl->bufs, 1 /* two pages per buffer */);
430 static void destroy_test_sglist(struct test_sglist *tsgl)
432 return __testmgr_free_buf(tsgl->bufs, 1 /* two pages per buffer */);
436 * build_test_sglist() - build a scatterlist for a crypto test
438 * @tsgl: the scatterlist to build. @tsgl->bufs[] contains an array of 2-page
439 * buffers which the scatterlist @tsgl->sgl[] will be made to point into.
440 * @divs: the layout specification on which the scatterlist will be based
441 * @alignmask: the algorithm's alignmask
442 * @total_len: the total length of the scatterlist to build in bytes
443 * @data: if non-NULL, the buffers will be filled with this data until it ends.
444 * Otherwise the buffers will be poisoned. In both cases, some bytes
445 * past the end of each buffer will be poisoned to help detect overruns.
446 * @out_divs: if non-NULL, the test_sg_division to which each scatterlist entry
447 * corresponds will be returned here. This will match @divs except
448 * that divisions resolving to a length of 0 are omitted as they are
449 * not included in the scatterlist.
451 * Return: 0 or a -errno value
453 static int build_test_sglist(struct test_sglist *tsgl,
454 const struct test_sg_division *divs,
455 const unsigned int alignmask,
456 const unsigned int total_len,
457 struct iov_iter *data,
458 const struct test_sg_division *out_divs[XBUFSIZE])
461 const struct test_sg_division *div;
463 } partitions[XBUFSIZE];
464 const unsigned int ndivs = count_test_sg_divisions(divs);
465 unsigned int len_remaining = total_len;
468 BUILD_BUG_ON(ARRAY_SIZE(partitions) != ARRAY_SIZE(tsgl->sgl));
469 if (WARN_ON(ndivs > ARRAY_SIZE(partitions)))
472 /* Calculate the (div, length) pairs */
474 for (i = 0; i < ndivs; i++) {
475 unsigned int len_this_sg =
477 (total_len * divs[i].proportion_of_total +
478 TEST_SG_TOTAL / 2) / TEST_SG_TOTAL);
480 if (len_this_sg != 0) {
481 partitions[tsgl->nents].div = &divs[i];
482 partitions[tsgl->nents].length = len_this_sg;
484 len_remaining -= len_this_sg;
487 if (tsgl->nents == 0) {
488 partitions[tsgl->nents].div = &divs[0];
489 partitions[tsgl->nents].length = 0;
492 partitions[tsgl->nents - 1].length += len_remaining;
494 /* Set up the sgl entries and fill the data or poison */
495 sg_init_table(tsgl->sgl, tsgl->nents);
496 for (i = 0; i < tsgl->nents; i++) {
497 unsigned int offset = partitions[i].div->offset;
500 if (partitions[i].div->offset_relative_to_alignmask)
503 while (offset + partitions[i].length + TESTMGR_POISON_LEN >
505 if (WARN_ON(offset <= 0))
510 addr = &tsgl->bufs[i][offset];
511 sg_set_buf(&tsgl->sgl[i], addr, partitions[i].length);
514 out_divs[i] = partitions[i].div;
517 size_t copy_len, copied;
519 copy_len = min(partitions[i].length, data->count);
520 copied = copy_from_iter(addr, copy_len, data);
521 if (WARN_ON(copied != copy_len))
523 testmgr_poison(addr + copy_len, partitions[i].length +
524 TESTMGR_POISON_LEN - copy_len);
526 testmgr_poison(addr, partitions[i].length +
531 sg_mark_end(&tsgl->sgl[tsgl->nents - 1]);
532 tsgl->sgl_ptr = tsgl->sgl;
533 memcpy(tsgl->sgl_saved, tsgl->sgl, tsgl->nents * sizeof(tsgl->sgl[0]));
538 * Verify that a scatterlist crypto operation produced the correct output.
540 * @tsgl: scatterlist containing the actual output
541 * @expected_output: buffer containing the expected output
542 * @len_to_check: length of @expected_output in bytes
543 * @unchecked_prefix_len: number of ignored bytes in @tsgl prior to real result
544 * @check_poison: verify that the poison bytes after each chunk are intact?
546 * Return: 0 if correct, -EINVAL if incorrect, -EOVERFLOW if buffer overrun.
548 static int verify_correct_output(const struct test_sglist *tsgl,
549 const char *expected_output,
550 unsigned int len_to_check,
551 unsigned int unchecked_prefix_len,
556 for (i = 0; i < tsgl->nents; i++) {
557 struct scatterlist *sg = &tsgl->sgl_ptr[i];
558 unsigned int len = sg->length;
559 unsigned int offset = sg->offset;
560 const char *actual_output;
562 if (unchecked_prefix_len) {
563 if (unchecked_prefix_len >= len) {
564 unchecked_prefix_len -= len;
567 offset += unchecked_prefix_len;
568 len -= unchecked_prefix_len;
569 unchecked_prefix_len = 0;
571 len = min(len, len_to_check);
572 actual_output = page_address(sg_page(sg)) + offset;
573 if (memcmp(expected_output, actual_output, len) != 0)
576 !testmgr_is_poison(actual_output + len, TESTMGR_POISON_LEN))
579 expected_output += len;
581 if (WARN_ON(len_to_check != 0))
586 static bool is_test_sglist_corrupted(const struct test_sglist *tsgl)
590 for (i = 0; i < tsgl->nents; i++) {
591 if (tsgl->sgl[i].page_link != tsgl->sgl_saved[i].page_link)
593 if (tsgl->sgl[i].offset != tsgl->sgl_saved[i].offset)
595 if (tsgl->sgl[i].length != tsgl->sgl_saved[i].length)
601 struct cipher_test_sglists {
602 struct test_sglist src;
603 struct test_sglist dst;
606 static struct cipher_test_sglists *alloc_cipher_test_sglists(void)
608 struct cipher_test_sglists *tsgls;
610 tsgls = kmalloc(sizeof(*tsgls), GFP_KERNEL);
614 if (init_test_sglist(&tsgls->src) != 0)
616 if (init_test_sglist(&tsgls->dst) != 0)
617 goto fail_destroy_src;
622 destroy_test_sglist(&tsgls->src);
628 static void free_cipher_test_sglists(struct cipher_test_sglists *tsgls)
631 destroy_test_sglist(&tsgls->src);
632 destroy_test_sglist(&tsgls->dst);
637 /* Build the src and dst scatterlists for an skcipher or AEAD test */
638 static int build_cipher_test_sglists(struct cipher_test_sglists *tsgls,
639 const struct testvec_config *cfg,
640 unsigned int alignmask,
641 unsigned int src_total_len,
642 unsigned int dst_total_len,
643 const struct kvec *inputs,
644 unsigned int nr_inputs)
646 struct iov_iter input;
649 iov_iter_kvec(&input, WRITE, inputs, nr_inputs, src_total_len);
650 err = build_test_sglist(&tsgls->src, cfg->src_divs, alignmask,
652 max(dst_total_len, src_total_len) :
659 tsgls->dst.sgl_ptr = tsgls->src.sgl;
660 tsgls->dst.nents = tsgls->src.nents;
663 return build_test_sglist(&tsgls->dst,
664 cfg->dst_divs[0].proportion_of_total ?
665 cfg->dst_divs : cfg->src_divs,
666 alignmask, dst_total_len, NULL, NULL);
669 #ifdef CONFIG_CRYPTO_MANAGER_EXTRA_TESTS
670 static char *generate_random_sgl_divisions(struct test_sg_division *divs,
671 size_t max_divs, char *p, char *end,
674 struct test_sg_division *div = divs;
675 unsigned int remaining = TEST_SG_TOTAL;
678 unsigned int this_len;
680 if (div == &divs[max_divs - 1] || prandom_u32() % 2 == 0)
681 this_len = remaining;
683 this_len = 1 + (prandom_u32() % remaining);
684 div->proportion_of_total = this_len;
686 if (prandom_u32() % 4 == 0)
687 div->offset = (PAGE_SIZE - 128) + (prandom_u32() % 128);
688 else if (prandom_u32() % 2 == 0)
689 div->offset = prandom_u32() % 32;
691 div->offset = prandom_u32() % PAGE_SIZE;
692 if (prandom_u32() % 8 == 0)
693 div->offset_relative_to_alignmask = true;
695 div->flush_type = FLUSH_TYPE_NONE;
697 switch (prandom_u32() % 4) {
699 div->flush_type = FLUSH_TYPE_REIMPORT;
702 div->flush_type = FLUSH_TYPE_FLUSH;
707 BUILD_BUG_ON(TEST_SG_TOTAL != 10000); /* for "%u.%u%%" */
708 p += scnprintf(p, end - p, "%s%u.%u%%@%s+%u%s",
709 div->flush_type == FLUSH_TYPE_NONE ? "" :
710 div->flush_type == FLUSH_TYPE_FLUSH ?
711 "<flush> " : "<reimport> ",
712 this_len / 100, this_len % 100,
713 div->offset_relative_to_alignmask ?
715 div->offset, this_len == remaining ? "" : ", ");
716 remaining -= this_len;
723 /* Generate a random testvec_config for fuzz testing */
724 static void generate_random_testvec_config(struct testvec_config *cfg,
725 char *name, size_t max_namelen)
728 char * const end = name + max_namelen;
730 memset(cfg, 0, sizeof(*cfg));
734 p += scnprintf(p, end - p, "random:");
736 if (prandom_u32() % 2 == 0) {
738 p += scnprintf(p, end - p, " inplace");
741 if (prandom_u32() % 2 == 0) {
742 cfg->req_flags |= CRYPTO_TFM_REQ_MAY_SLEEP;
743 p += scnprintf(p, end - p, " may_sleep");
746 switch (prandom_u32() % 4) {
748 cfg->finalization_type = FINALIZATION_TYPE_FINAL;
749 p += scnprintf(p, end - p, " use_final");
752 cfg->finalization_type = FINALIZATION_TYPE_FINUP;
753 p += scnprintf(p, end - p, " use_finup");
756 cfg->finalization_type = FINALIZATION_TYPE_DIGEST;
757 p += scnprintf(p, end - p, " use_digest");
761 p += scnprintf(p, end - p, " src_divs=[");
762 p = generate_random_sgl_divisions(cfg->src_divs,
763 ARRAY_SIZE(cfg->src_divs), p, end,
764 (cfg->finalization_type !=
765 FINALIZATION_TYPE_DIGEST));
766 p += scnprintf(p, end - p, "]");
768 if (!cfg->inplace && prandom_u32() % 2 == 0) {
769 p += scnprintf(p, end - p, " dst_divs=[");
770 p = generate_random_sgl_divisions(cfg->dst_divs,
771 ARRAY_SIZE(cfg->dst_divs),
773 p += scnprintf(p, end - p, "]");
776 if (prandom_u32() % 2 == 0) {
777 cfg->iv_offset = 1 + (prandom_u32() % MAX_ALGAPI_ALIGNMASK);
778 p += scnprintf(p, end - p, " iv_offset=%u", cfg->iv_offset);
781 WARN_ON_ONCE(!valid_testvec_config(cfg));
783 #endif /* CONFIG_CRYPTO_MANAGER_EXTRA_TESTS */
785 static int ahash_guard_result(char *result, char c, int size)
789 for (i = 0; i < size; i++) {
797 static int ahash_partial_update(struct ahash_request **preq,
798 struct crypto_ahash *tfm, const struct hash_testvec *template,
799 void *hash_buff, int k, int temp, struct scatterlist *sg,
800 const char *algo, char *result, struct crypto_wait *wait)
803 struct ahash_request *req;
804 int statesize, ret = -EINVAL;
805 static const unsigned char guard[] = { 0x00, 0xba, 0xad, 0x00 };
806 int digestsize = crypto_ahash_digestsize(tfm);
809 statesize = crypto_ahash_statesize(
810 crypto_ahash_reqtfm(req));
811 state = kmalloc(statesize + sizeof(guard), GFP_KERNEL);
813 pr_err("alg: hash: Failed to alloc state for %s\n", algo);
816 memcpy(state + statesize, guard, sizeof(guard));
817 memset(result, 1, digestsize);
818 ret = crypto_ahash_export(req, state);
819 WARN_ON(memcmp(state + statesize, guard, sizeof(guard)));
821 pr_err("alg: hash: Failed to export() for %s\n", algo);
824 ret = ahash_guard_result(result, 1, digestsize);
826 pr_err("alg: hash: Failed, export used req->result for %s\n",
830 ahash_request_free(req);
831 req = ahash_request_alloc(tfm, GFP_KERNEL);
833 pr_err("alg: hash: Failed to alloc request for %s\n", algo);
836 ahash_request_set_callback(req,
837 CRYPTO_TFM_REQ_MAY_BACKLOG,
838 crypto_req_done, wait);
840 memcpy(hash_buff, template->plaintext + temp,
842 sg_init_one(&sg[0], hash_buff, template->tap[k]);
843 ahash_request_set_crypt(req, sg, result, template->tap[k]);
844 ret = crypto_ahash_import(req, state);
846 pr_err("alg: hash: Failed to import() for %s\n", algo);
849 ret = ahash_guard_result(result, 1, digestsize);
851 pr_err("alg: hash: Failed, import used req->result for %s\n",
855 ret = crypto_wait_req(crypto_ahash_update(req), wait);
862 ahash_request_free(req);
875 static int __test_hash(struct crypto_ahash *tfm,
876 const struct hash_testvec *template, unsigned int tcount,
877 enum hash_test test_type, const int align_offset)
879 const char *algo = crypto_tfm_alg_driver_name(crypto_ahash_tfm(tfm));
880 size_t digest_size = crypto_ahash_digestsize(tfm);
881 unsigned int i, j, k, temp;
882 struct scatterlist sg[8];
885 struct ahash_request *req;
886 struct crypto_wait wait;
888 char *xbuf[XBUFSIZE];
891 result = kmalloc(digest_size, GFP_KERNEL);
894 key = kmalloc(MAX_KEYLEN, GFP_KERNEL);
897 if (testmgr_alloc_buf(xbuf))
900 crypto_init_wait(&wait);
902 req = ahash_request_alloc(tfm, GFP_KERNEL);
904 printk(KERN_ERR "alg: hash: Failed to allocate request for "
908 ahash_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG,
909 crypto_req_done, &wait);
912 for (i = 0; i < tcount; i++) {
917 if (WARN_ON(align_offset + template[i].psize > PAGE_SIZE))
921 memset(result, 0, digest_size);
924 hash_buff += align_offset;
926 memcpy(hash_buff, template[i].plaintext, template[i].psize);
927 sg_init_one(&sg[0], hash_buff, template[i].psize);
929 if (template[i].ksize) {
930 crypto_ahash_clear_flags(tfm, ~0);
931 if (template[i].ksize > MAX_KEYLEN) {
932 pr_err("alg: hash: setkey failed on test %d for %s: key size %d > %d\n",
933 j, algo, template[i].ksize, MAX_KEYLEN);
937 memcpy(key, template[i].key, template[i].ksize);
938 ret = crypto_ahash_setkey(tfm, key, template[i].ksize);
940 printk(KERN_ERR "alg: hash: setkey failed on "
941 "test %d for %s: ret=%d\n", j, algo,
947 ahash_request_set_crypt(req, sg, result, template[i].psize);
949 case HASH_TEST_DIGEST:
950 ret = crypto_wait_req(crypto_ahash_digest(req), &wait);
952 pr_err("alg: hash: digest failed on test %d "
953 "for %s: ret=%d\n", j, algo, -ret);
958 case HASH_TEST_FINAL:
959 memset(result, 1, digest_size);
960 ret = crypto_wait_req(crypto_ahash_init(req), &wait);
962 pr_err("alg: hash: init failed on test %d "
963 "for %s: ret=%d\n", j, algo, -ret);
966 ret = ahash_guard_result(result, 1, digest_size);
968 pr_err("alg: hash: init failed on test %d "
969 "for %s: used req->result\n", j, algo);
972 ret = crypto_wait_req(crypto_ahash_update(req), &wait);
974 pr_err("alg: hash: update failed on test %d "
975 "for %s: ret=%d\n", j, algo, -ret);
978 ret = ahash_guard_result(result, 1, digest_size);
980 pr_err("alg: hash: update failed on test %d "
981 "for %s: used req->result\n", j, algo);
984 ret = crypto_wait_req(crypto_ahash_final(req), &wait);
986 pr_err("alg: hash: final failed on test %d "
987 "for %s: ret=%d\n", j, algo, -ret);
992 case HASH_TEST_FINUP:
993 memset(result, 1, digest_size);
994 ret = crypto_wait_req(crypto_ahash_init(req), &wait);
996 pr_err("alg: hash: init failed on test %d "
997 "for %s: ret=%d\n", j, algo, -ret);
1000 ret = ahash_guard_result(result, 1, digest_size);
1002 pr_err("alg: hash: init failed on test %d "
1003 "for %s: used req->result\n", j, algo);
1006 ret = crypto_wait_req(crypto_ahash_finup(req), &wait);
1008 pr_err("alg: hash: final failed on test %d "
1009 "for %s: ret=%d\n", j, algo, -ret);
1015 if (memcmp(result, template[i].digest,
1016 crypto_ahash_digestsize(tfm))) {
1017 printk(KERN_ERR "alg: hash: Test %d failed for %s\n",
1019 hexdump(result, crypto_ahash_digestsize(tfm));
1029 for (i = 0; i < tcount; i++) {
1030 /* alignment tests are only done with continuous buffers */
1031 if (align_offset != 0)
1034 if (!template[i].np)
1038 memset(result, 0, digest_size);
1041 sg_init_table(sg, template[i].np);
1043 for (k = 0; k < template[i].np; k++) {
1044 if (WARN_ON(offset_in_page(IDX[k]) +
1045 template[i].tap[k] > PAGE_SIZE))
1048 memcpy(xbuf[IDX[k] >> PAGE_SHIFT] +
1049 offset_in_page(IDX[k]),
1050 template[i].plaintext + temp,
1051 template[i].tap[k]),
1052 template[i].tap[k]);
1053 temp += template[i].tap[k];
1056 if (template[i].ksize) {
1057 if (template[i].ksize > MAX_KEYLEN) {
1058 pr_err("alg: hash: setkey failed on test %d for %s: key size %d > %d\n",
1059 j, algo, template[i].ksize, MAX_KEYLEN);
1063 crypto_ahash_clear_flags(tfm, ~0);
1064 memcpy(key, template[i].key, template[i].ksize);
1065 ret = crypto_ahash_setkey(tfm, key, template[i].ksize);
1068 printk(KERN_ERR "alg: hash: setkey "
1069 "failed on chunking test %d "
1070 "for %s: ret=%d\n", j, algo, -ret);
1075 ahash_request_set_crypt(req, sg, result, template[i].psize);
1076 ret = crypto_wait_req(crypto_ahash_digest(req), &wait);
1078 pr_err("alg: hash: digest failed on chunking test %d for %s: ret=%d\n",
1083 if (memcmp(result, template[i].digest,
1084 crypto_ahash_digestsize(tfm))) {
1085 printk(KERN_ERR "alg: hash: Chunking test %d "
1086 "failed for %s\n", j, algo);
1087 hexdump(result, crypto_ahash_digestsize(tfm));
1093 /* partial update exercise */
1095 for (i = 0; i < tcount; i++) {
1096 /* alignment tests are only done with continuous buffers */
1097 if (align_offset != 0)
1100 if (template[i].np < 2)
1104 memset(result, 0, digest_size);
1107 hash_buff = xbuf[0];
1108 memcpy(hash_buff, template[i].plaintext,
1109 template[i].tap[0]);
1110 sg_init_one(&sg[0], hash_buff, template[i].tap[0]);
1112 if (template[i].ksize) {
1113 crypto_ahash_clear_flags(tfm, ~0);
1114 if (template[i].ksize > MAX_KEYLEN) {
1115 pr_err("alg: hash: setkey failed on test %d for %s: key size %d > %d\n",
1116 j, algo, template[i].ksize, MAX_KEYLEN);
1120 memcpy(key, template[i].key, template[i].ksize);
1121 ret = crypto_ahash_setkey(tfm, key, template[i].ksize);
1123 pr_err("alg: hash: setkey failed on test %d for %s: ret=%d\n",
1129 ahash_request_set_crypt(req, sg, result, template[i].tap[0]);
1130 ret = crypto_wait_req(crypto_ahash_init(req), &wait);
1132 pr_err("alg: hash: init failed on test %d for %s: ret=%d\n",
1136 ret = crypto_wait_req(crypto_ahash_update(req), &wait);
1138 pr_err("alg: hash: update failed on test %d for %s: ret=%d\n",
1143 temp = template[i].tap[0];
1144 for (k = 1; k < template[i].np; k++) {
1145 ret = ahash_partial_update(&req, tfm, &template[i],
1146 hash_buff, k, temp, &sg[0], algo, result,
1149 pr_err("alg: hash: partial update failed on test %d for %s: ret=%d\n",
1153 temp += template[i].tap[k];
1155 ret = crypto_wait_req(crypto_ahash_final(req), &wait);
1157 pr_err("alg: hash: final failed on test %d for %s: ret=%d\n",
1161 if (memcmp(result, template[i].digest,
1162 crypto_ahash_digestsize(tfm))) {
1163 pr_err("alg: hash: Partial Test %d failed for %s\n",
1165 hexdump(result, crypto_ahash_digestsize(tfm));
1174 ahash_request_free(req);
1176 testmgr_free_buf(xbuf);
1183 static int test_hash(struct crypto_ahash *tfm,
1184 const struct hash_testvec *template,
1185 unsigned int tcount, enum hash_test test_type)
1187 unsigned int alignmask;
1190 ret = __test_hash(tfm, template, tcount, test_type, 0);
1194 /* test unaligned buffers, check with one byte offset */
1195 ret = __test_hash(tfm, template, tcount, test_type, 1);
1199 alignmask = crypto_tfm_alg_alignmask(&tfm->base);
1201 /* Check if alignment mask for tfm is correctly set. */
1202 ret = __test_hash(tfm, template, tcount, test_type,
1211 static int __test_aead(struct crypto_aead *tfm, int enc,
1212 const struct aead_testvec *template, unsigned int tcount,
1213 const bool diff_dst, const int align_offset)
1215 const char *algo = crypto_tfm_alg_driver_name(crypto_aead_tfm(tfm));
1216 unsigned int i, j, k, n, temp;
1220 struct aead_request *req;
1221 struct scatterlist *sg;
1222 struct scatterlist *sgout;
1224 struct crypto_wait wait;
1225 unsigned int authsize, iv_len;
1227 char *xbuf[XBUFSIZE];
1228 char *xoutbuf[XBUFSIZE];
1229 char *axbuf[XBUFSIZE];
1231 iv = kzalloc(MAX_IVLEN, GFP_KERNEL);
1234 key = kmalloc(MAX_KEYLEN, GFP_KERNEL);
1237 if (testmgr_alloc_buf(xbuf))
1239 if (testmgr_alloc_buf(axbuf))
1241 if (diff_dst && testmgr_alloc_buf(xoutbuf))
1244 /* avoid "the frame size is larger than 1024 bytes" compiler warning */
1245 sg = kmalloc(array3_size(sizeof(*sg), 8, (diff_dst ? 4 : 2)),
1261 crypto_init_wait(&wait);
1263 req = aead_request_alloc(tfm, GFP_KERNEL);
1265 pr_err("alg: aead%s: Failed to allocate request for %s\n",
1270 aead_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG,
1271 crypto_req_done, &wait);
1273 iv_len = crypto_aead_ivsize(tfm);
1275 for (i = 0, j = 0; i < tcount; i++) {
1276 const char *input, *expected_output;
1277 unsigned int inlen, outlen;
1278 char *inbuf, *outbuf, *assocbuf;
1283 if (template[i].novrfy)
1285 input = template[i].ptext;
1286 inlen = template[i].plen;
1287 expected_output = template[i].ctext;
1288 outlen = template[i].clen;
1290 input = template[i].ctext;
1291 inlen = template[i].clen;
1292 expected_output = template[i].ptext;
1293 outlen = template[i].plen;
1298 /* some templates have no input data but they will
1301 inbuf = xbuf[0] + align_offset;
1302 assocbuf = axbuf[0];
1305 if (WARN_ON(align_offset + template[i].clen > PAGE_SIZE ||
1306 template[i].alen > PAGE_SIZE))
1309 memcpy(inbuf, input, inlen);
1310 memcpy(assocbuf, template[i].assoc, template[i].alen);
1312 memcpy(iv, template[i].iv, iv_len);
1314 memset(iv, 0, iv_len);
1316 crypto_aead_clear_flags(tfm, ~0);
1318 crypto_aead_set_flags(tfm,
1319 CRYPTO_TFM_REQ_FORBID_WEAK_KEYS);
1321 if (template[i].klen > MAX_KEYLEN) {
1322 pr_err("alg: aead%s: setkey failed on test %d for %s: key size %d > %d\n",
1323 d, j, algo, template[i].klen,
1328 memcpy(key, template[i].key, template[i].klen);
1330 ret = crypto_aead_setkey(tfm, key, template[i].klen);
1331 if (template[i].fail == !ret) {
1332 pr_err("alg: aead%s: setkey failed on test %d for %s: flags=%x\n",
1333 d, j, algo, crypto_aead_get_flags(tfm));
1338 authsize = template[i].clen - template[i].plen;
1339 ret = crypto_aead_setauthsize(tfm, authsize);
1341 pr_err("alg: aead%s: Failed to set authsize to %u on test %d for %s\n",
1342 d, authsize, j, algo);
1346 k = !!template[i].alen;
1347 sg_init_table(sg, k + 1);
1348 sg_set_buf(&sg[0], assocbuf, template[i].alen);
1349 sg_set_buf(&sg[k], inbuf, template[i].clen);
1353 sg_init_table(sgout, k + 1);
1354 sg_set_buf(&sgout[0], assocbuf, template[i].alen);
1356 outbuf = xoutbuf[0] + align_offset;
1357 sg_set_buf(&sgout[k], outbuf, template[i].clen);
1360 aead_request_set_crypt(req, sg, (diff_dst) ? sgout : sg, inlen,
1363 aead_request_set_ad(req, template[i].alen);
1365 ret = crypto_wait_req(enc ? crypto_aead_encrypt(req)
1366 : crypto_aead_decrypt(req), &wait);
1370 if (template[i].novrfy) {
1371 /* verification was supposed to fail */
1372 pr_err("alg: aead%s: %s failed on test %d for %s: ret was 0, expected -EBADMSG\n",
1374 /* so really, we got a bad message */
1380 if (template[i].novrfy)
1381 /* verification failure was expected */
1385 pr_err("alg: aead%s: %s failed on test %d for %s: ret=%d\n",
1386 d, e, j, algo, -ret);
1390 if (memcmp(outbuf, expected_output, outlen)) {
1391 pr_err("alg: aead%s: Test %d failed on %s for %s\n",
1393 hexdump(outbuf, outlen);
1399 for (i = 0, j = 0; i < tcount; i++) {
1400 const char *input, *expected_output;
1401 unsigned int inlen, outlen;
1403 /* alignment tests are only done with continuous buffers */
1404 if (align_offset != 0)
1407 if (!template[i].np)
1411 if (template[i].novrfy)
1413 input = template[i].ptext;
1414 inlen = template[i].plen;
1415 expected_output = template[i].ctext;
1416 outlen = template[i].clen;
1418 input = template[i].ctext;
1419 inlen = template[i].clen;
1420 expected_output = template[i].ptext;
1421 outlen = template[i].plen;
1427 memcpy(iv, template[i].iv, iv_len);
1429 memset(iv, 0, MAX_IVLEN);
1431 crypto_aead_clear_flags(tfm, ~0);
1433 crypto_aead_set_flags(tfm,
1434 CRYPTO_TFM_REQ_FORBID_WEAK_KEYS);
1435 if (template[i].klen > MAX_KEYLEN) {
1436 pr_err("alg: aead%s: setkey failed on test %d for %s: key size %d > %d\n",
1437 d, j, algo, template[i].klen, MAX_KEYLEN);
1441 memcpy(key, template[i].key, template[i].klen);
1443 ret = crypto_aead_setkey(tfm, key, template[i].klen);
1444 if (template[i].fail == !ret) {
1445 pr_err("alg: aead%s: setkey failed on chunk test %d for %s: flags=%x\n",
1446 d, j, algo, crypto_aead_get_flags(tfm));
1451 authsize = template[i].clen - template[i].plen;
1454 sg_init_table(sg, template[i].anp + template[i].np);
1456 sg_init_table(sgout, template[i].anp + template[i].np);
1459 for (k = 0, temp = 0; k < template[i].anp; k++) {
1460 if (WARN_ON(offset_in_page(IDX[k]) +
1461 template[i].atap[k] > PAGE_SIZE))
1464 memcpy(axbuf[IDX[k] >> PAGE_SHIFT] +
1465 offset_in_page(IDX[k]),
1466 template[i].assoc + temp,
1467 template[i].atap[k]),
1468 template[i].atap[k]);
1470 sg_set_buf(&sgout[k],
1471 axbuf[IDX[k] >> PAGE_SHIFT] +
1472 offset_in_page(IDX[k]),
1473 template[i].atap[k]);
1474 temp += template[i].atap[k];
1477 for (k = 0, temp = 0; k < template[i].np; k++) {
1478 n = template[i].tap[k];
1479 if (k == template[i].np - 1 && !enc)
1482 if (WARN_ON(offset_in_page(IDX[k]) + n > PAGE_SIZE))
1485 q = xbuf[IDX[k] >> PAGE_SHIFT] + offset_in_page(IDX[k]);
1486 memcpy(q, input + temp, n);
1487 sg_set_buf(&sg[template[i].anp + k], q, n);
1490 q = xoutbuf[IDX[k] >> PAGE_SHIFT] +
1491 offset_in_page(IDX[k]);
1495 sg_set_buf(&sgout[template[i].anp + k], q, n);
1498 if (k == template[i].np - 1 && enc)
1500 if (offset_in_page(q) + n < PAGE_SIZE)
1506 ret = crypto_aead_setauthsize(tfm, authsize);
1508 pr_err("alg: aead%s: Failed to set authsize to %u on chunk test %d for %s\n",
1509 d, authsize, j, algo);
1514 if (WARN_ON(sg[template[i].anp + k - 1].offset +
1515 sg[template[i].anp + k - 1].length +
1516 authsize > PAGE_SIZE)) {
1522 sgout[template[i].anp + k - 1].length +=
1524 sg[template[i].anp + k - 1].length += authsize;
1527 aead_request_set_crypt(req, sg, (diff_dst) ? sgout : sg,
1530 aead_request_set_ad(req, template[i].alen);
1532 ret = crypto_wait_req(enc ? crypto_aead_encrypt(req)
1533 : crypto_aead_decrypt(req), &wait);
1537 if (template[i].novrfy) {
1538 /* verification was supposed to fail */
1539 pr_err("alg: aead%s: %s failed on chunk test %d for %s: ret was 0, expected -EBADMSG\n",
1541 /* so really, we got a bad message */
1547 if (template[i].novrfy)
1548 /* verification failure was expected */
1552 pr_err("alg: aead%s: %s failed on chunk test %d for %s: ret=%d\n",
1553 d, e, j, algo, -ret);
1558 for (k = 0, temp = 0; k < template[i].np; k++) {
1560 q = xoutbuf[IDX[k] >> PAGE_SHIFT] +
1561 offset_in_page(IDX[k]);
1563 q = xbuf[IDX[k] >> PAGE_SHIFT] +
1564 offset_in_page(IDX[k]);
1566 n = template[i].tap[k];
1567 if (k == template[i].np - 1 && enc)
1570 if (memcmp(q, expected_output + temp, n)) {
1571 pr_err("alg: aead%s: Chunk test %d failed on %s at page %u for %s\n",
1578 if (k == template[i].np - 1 && !enc) {
1579 if (!diff_dst && memcmp(q, input + temp + n,
1585 for (n = 0; offset_in_page(q + n) && q[n]; n++)
1589 pr_err("alg: aead%s: Result buffer corruption in chunk test %d on %s at page %u for %s: %u bytes:\n",
1590 d, j, e, k, algo, n);
1595 temp += template[i].tap[k];
1602 aead_request_free(req);
1606 testmgr_free_buf(xoutbuf);
1608 testmgr_free_buf(axbuf);
1610 testmgr_free_buf(xbuf);
1617 static int test_aead(struct crypto_aead *tfm, int enc,
1618 const struct aead_testvec *template, unsigned int tcount)
1620 unsigned int alignmask;
1623 /* test 'dst == src' case */
1624 ret = __test_aead(tfm, enc, template, tcount, false, 0);
1628 /* test 'dst != src' case */
1629 ret = __test_aead(tfm, enc, template, tcount, true, 0);
1633 /* test unaligned buffers, check with one byte offset */
1634 ret = __test_aead(tfm, enc, template, tcount, true, 1);
1638 alignmask = crypto_tfm_alg_alignmask(&tfm->base);
1640 /* Check if alignment mask for tfm is correctly set. */
1641 ret = __test_aead(tfm, enc, template, tcount, true,
1650 static int test_cipher(struct crypto_cipher *tfm, int enc,
1651 const struct cipher_testvec *template,
1652 unsigned int tcount)
1654 const char *algo = crypto_tfm_alg_driver_name(crypto_cipher_tfm(tfm));
1655 unsigned int i, j, k;
1658 const char *input, *result;
1660 char *xbuf[XBUFSIZE];
1663 if (testmgr_alloc_buf(xbuf))
1672 for (i = 0; i < tcount; i++) {
1674 if (fips_enabled && template[i].fips_skip)
1677 input = enc ? template[i].ptext : template[i].ctext;
1678 result = enc ? template[i].ctext : template[i].ptext;
1682 if (WARN_ON(template[i].len > PAGE_SIZE))
1686 memcpy(data, input, template[i].len);
1688 crypto_cipher_clear_flags(tfm, ~0);
1690 crypto_cipher_set_flags(tfm, CRYPTO_TFM_REQ_FORBID_WEAK_KEYS);
1692 ret = crypto_cipher_setkey(tfm, template[i].key,
1694 if (template[i].fail == !ret) {
1695 printk(KERN_ERR "alg: cipher: setkey failed "
1696 "on test %d for %s: flags=%x\n", j,
1697 algo, crypto_cipher_get_flags(tfm));
1702 for (k = 0; k < template[i].len;
1703 k += crypto_cipher_blocksize(tfm)) {
1705 crypto_cipher_encrypt_one(tfm, data + k,
1708 crypto_cipher_decrypt_one(tfm, data + k,
1713 if (memcmp(q, result, template[i].len)) {
1714 printk(KERN_ERR "alg: cipher: Test %d failed "
1715 "on %s for %s\n", j, e, algo);
1716 hexdump(q, template[i].len);
1725 testmgr_free_buf(xbuf);
1730 static int test_skcipher_vec_cfg(const char *driver, int enc,
1731 const struct cipher_testvec *vec,
1732 unsigned int vec_num,
1733 const struct testvec_config *cfg,
1734 struct skcipher_request *req,
1735 struct cipher_test_sglists *tsgls)
1737 struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
1738 const unsigned int alignmask = crypto_skcipher_alignmask(tfm);
1739 const unsigned int ivsize = crypto_skcipher_ivsize(tfm);
1740 const u32 req_flags = CRYPTO_TFM_REQ_MAY_BACKLOG | cfg->req_flags;
1741 const char *op = enc ? "encryption" : "decryption";
1742 DECLARE_CRYPTO_WAIT(wait);
1743 u8 _iv[3 * (MAX_ALGAPI_ALIGNMASK + 1) + MAX_IVLEN];
1744 u8 *iv = PTR_ALIGN(&_iv[0], 2 * (MAX_ALGAPI_ALIGNMASK + 1)) +
1746 (cfg->iv_offset_relative_to_alignmask ? alignmask : 0);
1752 crypto_skcipher_set_flags(tfm, CRYPTO_TFM_REQ_FORBID_WEAK_KEYS);
1754 crypto_skcipher_clear_flags(tfm,
1755 CRYPTO_TFM_REQ_FORBID_WEAK_KEYS);
1756 err = crypto_skcipher_setkey(tfm, vec->key, vec->klen);
1758 if (vec->fail) /* expectedly failed to set key? */
1760 pr_err("alg: skcipher: %s setkey failed with err %d on test vector %u; flags=%#x\n",
1761 driver, err, vec_num, crypto_skcipher_get_flags(tfm));
1765 pr_err("alg: skcipher: %s setkey unexpectedly succeeded on test vector %u\n",
1770 /* The IV must be copied to a buffer, as the algorithm may modify it */
1772 if (WARN_ON(ivsize > MAX_IVLEN))
1774 if (vec->iv && !(vec->generates_iv && enc))
1775 memcpy(iv, vec->iv, ivsize);
1777 memset(iv, 0, ivsize);
1779 if (vec->generates_iv) {
1780 pr_err("alg: skcipher: %s has ivsize=0 but test vector %u generates IV!\n",
1787 /* Build the src/dst scatterlists */
1788 input.iov_base = enc ? (void *)vec->ptext : (void *)vec->ctext;
1789 input.iov_len = vec->len;
1790 err = build_cipher_test_sglists(tsgls, cfg, alignmask,
1791 vec->len, vec->len, &input, 1);
1793 pr_err("alg: skcipher: %s %s: error preparing scatterlists for test vector %u, cfg=\"%s\"\n",
1794 driver, op, vec_num, cfg->name);
1798 /* Do the actual encryption or decryption */
1799 testmgr_poison(req->__ctx, crypto_skcipher_reqsize(tfm));
1800 skcipher_request_set_callback(req, req_flags, crypto_req_done, &wait);
1801 skcipher_request_set_crypt(req, tsgls->src.sgl_ptr, tsgls->dst.sgl_ptr,
1803 err = crypto_wait_req(enc ? crypto_skcipher_encrypt(req) :
1804 crypto_skcipher_decrypt(req), &wait);
1806 pr_err("alg: skcipher: %s %s failed with err %d on test vector %u, cfg=\"%s\"\n",
1807 driver, op, err, vec_num, cfg->name);
1811 /* Check for the correct output (ciphertext or plaintext) */
1812 err = verify_correct_output(&tsgls->dst, enc ? vec->ctext : vec->ptext,
1814 if (err == -EOVERFLOW) {
1815 pr_err("alg: skcipher: %s %s overran dst buffer on test vector %u, cfg=\"%s\"\n",
1816 driver, op, vec_num, cfg->name);
1820 pr_err("alg: skcipher: %s %s test failed (wrong result) on test vector %u, cfg=\"%s\"\n",
1821 driver, op, vec_num, cfg->name);
1825 /* If applicable, check that the algorithm generated the correct IV */
1826 if (vec->generates_iv && enc && memcmp(iv, vec->iv, ivsize) != 0) {
1827 pr_err("alg: skcipher: %s %s test failed (wrong output IV) on test vector %u, cfg=\"%s\"\n",
1828 driver, op, vec_num, cfg->name);
1829 hexdump(iv, ivsize);
1836 static int test_skcipher_vec(const char *driver, int enc,
1837 const struct cipher_testvec *vec,
1838 unsigned int vec_num,
1839 struct skcipher_request *req,
1840 struct cipher_test_sglists *tsgls)
1845 if (fips_enabled && vec->fips_skip)
1848 for (i = 0; i < ARRAY_SIZE(default_cipher_testvec_configs); i++) {
1849 err = test_skcipher_vec_cfg(driver, enc, vec, vec_num,
1850 &default_cipher_testvec_configs[i],
1856 #ifdef CONFIG_CRYPTO_MANAGER_EXTRA_TESTS
1857 if (!noextratests) {
1858 struct testvec_config cfg;
1859 char cfgname[TESTVEC_CONFIG_NAMELEN];
1861 for (i = 0; i < fuzz_iterations; i++) {
1862 generate_random_testvec_config(&cfg, cfgname,
1864 err = test_skcipher_vec_cfg(driver, enc, vec, vec_num,
1874 static int test_skcipher(const char *driver, int enc,
1875 const struct cipher_test_suite *suite,
1876 struct skcipher_request *req,
1877 struct cipher_test_sglists *tsgls)
1882 for (i = 0; i < suite->count; i++) {
1883 err = test_skcipher_vec(driver, enc, &suite->vecs[i], i, req,
1891 static int alg_test_skcipher(const struct alg_test_desc *desc,
1892 const char *driver, u32 type, u32 mask)
1894 const struct cipher_test_suite *suite = &desc->suite.cipher;
1895 struct crypto_skcipher *tfm;
1896 struct skcipher_request *req = NULL;
1897 struct cipher_test_sglists *tsgls = NULL;
1900 if (suite->count <= 0) {
1901 pr_err("alg: skcipher: empty test suite for %s\n", driver);
1905 tfm = crypto_alloc_skcipher(driver, type, mask);
1907 pr_err("alg: skcipher: failed to allocate transform for %s: %ld\n",
1908 driver, PTR_ERR(tfm));
1909 return PTR_ERR(tfm);
1912 req = skcipher_request_alloc(tfm, GFP_KERNEL);
1914 pr_err("alg: skcipher: failed to allocate request for %s\n",
1920 tsgls = alloc_cipher_test_sglists();
1922 pr_err("alg: skcipher: failed to allocate test buffers for %s\n",
1928 err = test_skcipher(driver, ENCRYPT, suite, req, tsgls);
1932 err = test_skcipher(driver, DECRYPT, suite, req, tsgls);
1934 free_cipher_test_sglists(tsgls);
1935 skcipher_request_free(req);
1936 crypto_free_skcipher(tfm);
1940 static int test_comp(struct crypto_comp *tfm,
1941 const struct comp_testvec *ctemplate,
1942 const struct comp_testvec *dtemplate,
1943 int ctcount, int dtcount)
1945 const char *algo = crypto_tfm_alg_driver_name(crypto_comp_tfm(tfm));
1946 char *output, *decomp_output;
1950 output = kmalloc(COMP_BUF_SIZE, GFP_KERNEL);
1954 decomp_output = kmalloc(COMP_BUF_SIZE, GFP_KERNEL);
1955 if (!decomp_output) {
1960 for (i = 0; i < ctcount; i++) {
1962 unsigned int dlen = COMP_BUF_SIZE;
1964 memset(output, 0, COMP_BUF_SIZE);
1965 memset(decomp_output, 0, COMP_BUF_SIZE);
1967 ilen = ctemplate[i].inlen;
1968 ret = crypto_comp_compress(tfm, ctemplate[i].input,
1969 ilen, output, &dlen);
1971 printk(KERN_ERR "alg: comp: compression failed "
1972 "on test %d for %s: ret=%d\n", i + 1, algo,
1978 dlen = COMP_BUF_SIZE;
1979 ret = crypto_comp_decompress(tfm, output,
1980 ilen, decomp_output, &dlen);
1982 pr_err("alg: comp: compression failed: decompress: on test %d for %s failed: ret=%d\n",
1987 if (dlen != ctemplate[i].inlen) {
1988 printk(KERN_ERR "alg: comp: Compression test %d "
1989 "failed for %s: output len = %d\n", i + 1, algo,
1995 if (memcmp(decomp_output, ctemplate[i].input,
1996 ctemplate[i].inlen)) {
1997 pr_err("alg: comp: compression failed: output differs: on test %d for %s\n",
1999 hexdump(decomp_output, dlen);
2005 for (i = 0; i < dtcount; i++) {
2007 unsigned int dlen = COMP_BUF_SIZE;
2009 memset(decomp_output, 0, COMP_BUF_SIZE);
2011 ilen = dtemplate[i].inlen;
2012 ret = crypto_comp_decompress(tfm, dtemplate[i].input,
2013 ilen, decomp_output, &dlen);
2015 printk(KERN_ERR "alg: comp: decompression failed "
2016 "on test %d for %s: ret=%d\n", i + 1, algo,
2021 if (dlen != dtemplate[i].outlen) {
2022 printk(KERN_ERR "alg: comp: Decompression test %d "
2023 "failed for %s: output len = %d\n", i + 1, algo,
2029 if (memcmp(decomp_output, dtemplate[i].output, dlen)) {
2030 printk(KERN_ERR "alg: comp: Decompression test %d "
2031 "failed for %s\n", i + 1, algo);
2032 hexdump(decomp_output, dlen);
2041 kfree(decomp_output);
2046 static int test_acomp(struct crypto_acomp *tfm,
2047 const struct comp_testvec *ctemplate,
2048 const struct comp_testvec *dtemplate,
2049 int ctcount, int dtcount)
2051 const char *algo = crypto_tfm_alg_driver_name(crypto_acomp_tfm(tfm));
2053 char *output, *decomp_out;
2055 struct scatterlist src, dst;
2056 struct acomp_req *req;
2057 struct crypto_wait wait;
2059 output = kmalloc(COMP_BUF_SIZE, GFP_KERNEL);
2063 decomp_out = kmalloc(COMP_BUF_SIZE, GFP_KERNEL);
2069 for (i = 0; i < ctcount; i++) {
2070 unsigned int dlen = COMP_BUF_SIZE;
2071 int ilen = ctemplate[i].inlen;
2074 input_vec = kmemdup(ctemplate[i].input, ilen, GFP_KERNEL);
2080 memset(output, 0, dlen);
2081 crypto_init_wait(&wait);
2082 sg_init_one(&src, input_vec, ilen);
2083 sg_init_one(&dst, output, dlen);
2085 req = acomp_request_alloc(tfm);
2087 pr_err("alg: acomp: request alloc failed for %s\n",
2094 acomp_request_set_params(req, &src, &dst, ilen, dlen);
2095 acomp_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG,
2096 crypto_req_done, &wait);
2098 ret = crypto_wait_req(crypto_acomp_compress(req), &wait);
2100 pr_err("alg: acomp: compression failed on test %d for %s: ret=%d\n",
2103 acomp_request_free(req);
2108 dlen = COMP_BUF_SIZE;
2109 sg_init_one(&src, output, ilen);
2110 sg_init_one(&dst, decomp_out, dlen);
2111 crypto_init_wait(&wait);
2112 acomp_request_set_params(req, &src, &dst, ilen, dlen);
2114 ret = crypto_wait_req(crypto_acomp_decompress(req), &wait);
2116 pr_err("alg: acomp: compression failed on test %d for %s: ret=%d\n",
2119 acomp_request_free(req);
2123 if (req->dlen != ctemplate[i].inlen) {
2124 pr_err("alg: acomp: Compression test %d failed for %s: output len = %d\n",
2125 i + 1, algo, req->dlen);
2128 acomp_request_free(req);
2132 if (memcmp(input_vec, decomp_out, req->dlen)) {
2133 pr_err("alg: acomp: Compression test %d failed for %s\n",
2135 hexdump(output, req->dlen);
2138 acomp_request_free(req);
2143 acomp_request_free(req);
2146 for (i = 0; i < dtcount; i++) {
2147 unsigned int dlen = COMP_BUF_SIZE;
2148 int ilen = dtemplate[i].inlen;
2151 input_vec = kmemdup(dtemplate[i].input, ilen, GFP_KERNEL);
2157 memset(output, 0, dlen);
2158 crypto_init_wait(&wait);
2159 sg_init_one(&src, input_vec, ilen);
2160 sg_init_one(&dst, output, dlen);
2162 req = acomp_request_alloc(tfm);
2164 pr_err("alg: acomp: request alloc failed for %s\n",
2171 acomp_request_set_params(req, &src, &dst, ilen, dlen);
2172 acomp_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG,
2173 crypto_req_done, &wait);
2175 ret = crypto_wait_req(crypto_acomp_decompress(req), &wait);
2177 pr_err("alg: acomp: decompression failed on test %d for %s: ret=%d\n",
2180 acomp_request_free(req);
2184 if (req->dlen != dtemplate[i].outlen) {
2185 pr_err("alg: acomp: Decompression test %d failed for %s: output len = %d\n",
2186 i + 1, algo, req->dlen);
2189 acomp_request_free(req);
2193 if (memcmp(output, dtemplate[i].output, req->dlen)) {
2194 pr_err("alg: acomp: Decompression test %d failed for %s\n",
2196 hexdump(output, req->dlen);
2199 acomp_request_free(req);
2204 acomp_request_free(req);
2215 static int test_cprng(struct crypto_rng *tfm,
2216 const struct cprng_testvec *template,
2217 unsigned int tcount)
2219 const char *algo = crypto_tfm_alg_driver_name(crypto_rng_tfm(tfm));
2220 int err = 0, i, j, seedsize;
2224 seedsize = crypto_rng_seedsize(tfm);
2226 seed = kmalloc(seedsize, GFP_KERNEL);
2228 printk(KERN_ERR "alg: cprng: Failed to allocate seed space "
2233 for (i = 0; i < tcount; i++) {
2234 memset(result, 0, 32);
2236 memcpy(seed, template[i].v, template[i].vlen);
2237 memcpy(seed + template[i].vlen, template[i].key,
2239 memcpy(seed + template[i].vlen + template[i].klen,
2240 template[i].dt, template[i].dtlen);
2242 err = crypto_rng_reset(tfm, seed, seedsize);
2244 printk(KERN_ERR "alg: cprng: Failed to reset rng "
2249 for (j = 0; j < template[i].loops; j++) {
2250 err = crypto_rng_get_bytes(tfm, result,
2253 printk(KERN_ERR "alg: cprng: Failed to obtain "
2254 "the correct amount of random data for "
2255 "%s (requested %d)\n", algo,
2261 err = memcmp(result, template[i].result,
2264 printk(KERN_ERR "alg: cprng: Test %d failed for %s\n",
2266 hexdump(result, template[i].rlen);
2277 static int alg_test_aead(const struct alg_test_desc *desc, const char *driver,
2280 const struct aead_test_suite *suite = &desc->suite.aead;
2281 struct crypto_aead *tfm;
2284 tfm = crypto_alloc_aead(driver, type, mask);
2286 printk(KERN_ERR "alg: aead: Failed to load transform for %s: "
2287 "%ld\n", driver, PTR_ERR(tfm));
2288 return PTR_ERR(tfm);
2291 err = test_aead(tfm, ENCRYPT, suite->vecs, suite->count);
2293 err = test_aead(tfm, DECRYPT, suite->vecs, suite->count);
2295 crypto_free_aead(tfm);
2299 static int alg_test_cipher(const struct alg_test_desc *desc,
2300 const char *driver, u32 type, u32 mask)
2302 const struct cipher_test_suite *suite = &desc->suite.cipher;
2303 struct crypto_cipher *tfm;
2306 tfm = crypto_alloc_cipher(driver, type, mask);
2308 printk(KERN_ERR "alg: cipher: Failed to load transform for "
2309 "%s: %ld\n", driver, PTR_ERR(tfm));
2310 return PTR_ERR(tfm);
2313 err = test_cipher(tfm, ENCRYPT, suite->vecs, suite->count);
2315 err = test_cipher(tfm, DECRYPT, suite->vecs, suite->count);
2317 crypto_free_cipher(tfm);
2321 static int alg_test_comp(const struct alg_test_desc *desc, const char *driver,
2324 struct crypto_comp *comp;
2325 struct crypto_acomp *acomp;
2327 u32 algo_type = type & CRYPTO_ALG_TYPE_ACOMPRESS_MASK;
2329 if (algo_type == CRYPTO_ALG_TYPE_ACOMPRESS) {
2330 acomp = crypto_alloc_acomp(driver, type, mask);
2331 if (IS_ERR(acomp)) {
2332 pr_err("alg: acomp: Failed to load transform for %s: %ld\n",
2333 driver, PTR_ERR(acomp));
2334 return PTR_ERR(acomp);
2336 err = test_acomp(acomp, desc->suite.comp.comp.vecs,
2337 desc->suite.comp.decomp.vecs,
2338 desc->suite.comp.comp.count,
2339 desc->suite.comp.decomp.count);
2340 crypto_free_acomp(acomp);
2342 comp = crypto_alloc_comp(driver, type, mask);
2344 pr_err("alg: comp: Failed to load transform for %s: %ld\n",
2345 driver, PTR_ERR(comp));
2346 return PTR_ERR(comp);
2349 err = test_comp(comp, desc->suite.comp.comp.vecs,
2350 desc->suite.comp.decomp.vecs,
2351 desc->suite.comp.comp.count,
2352 desc->suite.comp.decomp.count);
2354 crypto_free_comp(comp);
2359 static int __alg_test_hash(const struct hash_testvec *template,
2360 unsigned int tcount, const char *driver,
2363 struct crypto_ahash *tfm;
2366 tfm = crypto_alloc_ahash(driver, type, mask);
2368 printk(KERN_ERR "alg: hash: Failed to load transform for %s: "
2369 "%ld\n", driver, PTR_ERR(tfm));
2370 return PTR_ERR(tfm);
2373 err = test_hash(tfm, template, tcount, HASH_TEST_DIGEST);
2375 err = test_hash(tfm, template, tcount, HASH_TEST_FINAL);
2377 err = test_hash(tfm, template, tcount, HASH_TEST_FINUP);
2378 crypto_free_ahash(tfm);
2382 static int alg_test_hash(const struct alg_test_desc *desc, const char *driver,
2385 const struct hash_testvec *template = desc->suite.hash.vecs;
2386 unsigned int tcount = desc->suite.hash.count;
2387 unsigned int nr_unkeyed, nr_keyed;
2391 * For OPTIONAL_KEY algorithms, we have to do all the unkeyed tests
2392 * first, before setting a key on the tfm. To make this easier, we
2393 * require that the unkeyed test vectors (if any) are listed first.
2396 for (nr_unkeyed = 0; nr_unkeyed < tcount; nr_unkeyed++) {
2397 if (template[nr_unkeyed].ksize)
2400 for (nr_keyed = 0; nr_unkeyed + nr_keyed < tcount; nr_keyed++) {
2401 if (!template[nr_unkeyed + nr_keyed].ksize) {
2402 pr_err("alg: hash: test vectors for %s out of order, "
2403 "unkeyed ones must come first\n", desc->alg);
2410 err = __alg_test_hash(template, nr_unkeyed, driver, type, mask);
2411 template += nr_unkeyed;
2414 if (!err && nr_keyed)
2415 err = __alg_test_hash(template, nr_keyed, driver, type, mask);
2420 static int alg_test_crc32c(const struct alg_test_desc *desc,
2421 const char *driver, u32 type, u32 mask)
2423 struct crypto_shash *tfm;
2427 err = alg_test_hash(desc, driver, type, mask);
2431 tfm = crypto_alloc_shash(driver, type, mask);
2433 if (PTR_ERR(tfm) == -ENOENT) {
2435 * This crc32c implementation is only available through
2436 * ahash API, not the shash API, so the remaining part
2437 * of the test is not applicable to it.
2441 printk(KERN_ERR "alg: crc32c: Failed to load transform for %s: "
2442 "%ld\n", driver, PTR_ERR(tfm));
2443 return PTR_ERR(tfm);
2447 SHASH_DESC_ON_STACK(shash, tfm);
2448 u32 *ctx = (u32 *)shash_desc_ctx(shash);
2454 err = crypto_shash_final(shash, (u8 *)&val);
2456 printk(KERN_ERR "alg: crc32c: Operation failed for "
2457 "%s: %d\n", driver, err);
2461 if (val != cpu_to_le32(~420553207)) {
2462 pr_err("alg: crc32c: Test failed for %s: %u\n",
2463 driver, le32_to_cpu(val));
2468 crypto_free_shash(tfm);
2473 static int alg_test_cprng(const struct alg_test_desc *desc, const char *driver,
2476 struct crypto_rng *rng;
2479 rng = crypto_alloc_rng(driver, type, mask);
2481 printk(KERN_ERR "alg: cprng: Failed to load transform for %s: "
2482 "%ld\n", driver, PTR_ERR(rng));
2483 return PTR_ERR(rng);
2486 err = test_cprng(rng, desc->suite.cprng.vecs, desc->suite.cprng.count);
2488 crypto_free_rng(rng);
2494 static int drbg_cavs_test(const struct drbg_testvec *test, int pr,
2495 const char *driver, u32 type, u32 mask)
2498 struct crypto_rng *drng;
2499 struct drbg_test_data test_data;
2500 struct drbg_string addtl, pers, testentropy;
2501 unsigned char *buf = kzalloc(test->expectedlen, GFP_KERNEL);
2506 drng = crypto_alloc_rng(driver, type, mask);
2508 printk(KERN_ERR "alg: drbg: could not allocate DRNG handle for "
2514 test_data.testentropy = &testentropy;
2515 drbg_string_fill(&testentropy, test->entropy, test->entropylen);
2516 drbg_string_fill(&pers, test->pers, test->perslen);
2517 ret = crypto_drbg_reset_test(drng, &pers, &test_data);
2519 printk(KERN_ERR "alg: drbg: Failed to reset rng\n");
2523 drbg_string_fill(&addtl, test->addtla, test->addtllen);
2525 drbg_string_fill(&testentropy, test->entpra, test->entprlen);
2526 ret = crypto_drbg_get_bytes_addtl_test(drng,
2527 buf, test->expectedlen, &addtl, &test_data);
2529 ret = crypto_drbg_get_bytes_addtl(drng,
2530 buf, test->expectedlen, &addtl);
2533 printk(KERN_ERR "alg: drbg: could not obtain random data for "
2534 "driver %s\n", driver);
2538 drbg_string_fill(&addtl, test->addtlb, test->addtllen);
2540 drbg_string_fill(&testentropy, test->entprb, test->entprlen);
2541 ret = crypto_drbg_get_bytes_addtl_test(drng,
2542 buf, test->expectedlen, &addtl, &test_data);
2544 ret = crypto_drbg_get_bytes_addtl(drng,
2545 buf, test->expectedlen, &addtl);
2548 printk(KERN_ERR "alg: drbg: could not obtain random data for "
2549 "driver %s\n", driver);
2553 ret = memcmp(test->expected, buf, test->expectedlen);
2556 crypto_free_rng(drng);
2562 static int alg_test_drbg(const struct alg_test_desc *desc, const char *driver,
2568 const struct drbg_testvec *template = desc->suite.drbg.vecs;
2569 unsigned int tcount = desc->suite.drbg.count;
2571 if (0 == memcmp(driver, "drbg_pr_", 8))
2574 for (i = 0; i < tcount; i++) {
2575 err = drbg_cavs_test(&template[i], pr, driver, type, mask);
2577 printk(KERN_ERR "alg: drbg: Test %d failed for %s\n",
2587 static int do_test_kpp(struct crypto_kpp *tfm, const struct kpp_testvec *vec,
2590 struct kpp_request *req;
2591 void *input_buf = NULL;
2592 void *output_buf = NULL;
2593 void *a_public = NULL;
2595 void *shared_secret = NULL;
2596 struct crypto_wait wait;
2597 unsigned int out_len_max;
2599 struct scatterlist src, dst;
2601 req = kpp_request_alloc(tfm, GFP_KERNEL);
2605 crypto_init_wait(&wait);
2607 err = crypto_kpp_set_secret(tfm, vec->secret, vec->secret_size);
2611 out_len_max = crypto_kpp_maxsize(tfm);
2612 output_buf = kzalloc(out_len_max, GFP_KERNEL);
2618 /* Use appropriate parameter as base */
2619 kpp_request_set_input(req, NULL, 0);
2620 sg_init_one(&dst, output_buf, out_len_max);
2621 kpp_request_set_output(req, &dst, out_len_max);
2622 kpp_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG,
2623 crypto_req_done, &wait);
2625 /* Compute party A's public key */
2626 err = crypto_wait_req(crypto_kpp_generate_public_key(req), &wait);
2628 pr_err("alg: %s: Party A: generate public key test failed. err %d\n",
2634 /* Save party A's public key */
2635 a_public = kmemdup(sg_virt(req->dst), out_len_max, GFP_KERNEL);
2641 /* Verify calculated public key */
2642 if (memcmp(vec->expected_a_public, sg_virt(req->dst),
2643 vec->expected_a_public_size)) {
2644 pr_err("alg: %s: Party A: generate public key test failed. Invalid output\n",
2651 /* Calculate shared secret key by using counter part (b) public key. */
2652 input_buf = kmemdup(vec->b_public, vec->b_public_size, GFP_KERNEL);
2658 sg_init_one(&src, input_buf, vec->b_public_size);
2659 sg_init_one(&dst, output_buf, out_len_max);
2660 kpp_request_set_input(req, &src, vec->b_public_size);
2661 kpp_request_set_output(req, &dst, out_len_max);
2662 kpp_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG,
2663 crypto_req_done, &wait);
2664 err = crypto_wait_req(crypto_kpp_compute_shared_secret(req), &wait);
2666 pr_err("alg: %s: Party A: compute shared secret test failed. err %d\n",
2672 /* Save the shared secret obtained by party A */
2673 a_ss = kmemdup(sg_virt(req->dst), vec->expected_ss_size, GFP_KERNEL);
2680 * Calculate party B's shared secret by using party A's
2683 err = crypto_kpp_set_secret(tfm, vec->b_secret,
2684 vec->b_secret_size);
2688 sg_init_one(&src, a_public, vec->expected_a_public_size);
2689 sg_init_one(&dst, output_buf, out_len_max);
2690 kpp_request_set_input(req, &src, vec->expected_a_public_size);
2691 kpp_request_set_output(req, &dst, out_len_max);
2692 kpp_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG,
2693 crypto_req_done, &wait);
2694 err = crypto_wait_req(crypto_kpp_compute_shared_secret(req),
2697 pr_err("alg: %s: Party B: compute shared secret failed. err %d\n",
2702 shared_secret = a_ss;
2704 shared_secret = (void *)vec->expected_ss;
2708 * verify shared secret from which the user will derive
2709 * secret key by executing whatever hash it has chosen
2711 if (memcmp(shared_secret, sg_virt(req->dst),
2712 vec->expected_ss_size)) {
2713 pr_err("alg: %s: compute shared secret test failed. Invalid output\n",
2725 kpp_request_free(req);
2729 static int test_kpp(struct crypto_kpp *tfm, const char *alg,
2730 const struct kpp_testvec *vecs, unsigned int tcount)
2734 for (i = 0; i < tcount; i++) {
2735 ret = do_test_kpp(tfm, vecs++, alg);
2737 pr_err("alg: %s: test failed on vector %d, err=%d\n",
2745 static int alg_test_kpp(const struct alg_test_desc *desc, const char *driver,
2748 struct crypto_kpp *tfm;
2751 tfm = crypto_alloc_kpp(driver, type, mask);
2753 pr_err("alg: kpp: Failed to load tfm for %s: %ld\n",
2754 driver, PTR_ERR(tfm));
2755 return PTR_ERR(tfm);
2757 if (desc->suite.kpp.vecs)
2758 err = test_kpp(tfm, desc->alg, desc->suite.kpp.vecs,
2759 desc->suite.kpp.count);
2761 crypto_free_kpp(tfm);
2765 static int test_akcipher_one(struct crypto_akcipher *tfm,
2766 const struct akcipher_testvec *vecs)
2768 char *xbuf[XBUFSIZE];
2769 struct akcipher_request *req;
2770 void *outbuf_enc = NULL;
2771 void *outbuf_dec = NULL;
2772 struct crypto_wait wait;
2773 unsigned int out_len_max, out_len = 0;
2775 struct scatterlist src, dst, src_tab[2];
2777 unsigned int m_size, c_size;
2780 if (testmgr_alloc_buf(xbuf))
2783 req = akcipher_request_alloc(tfm, GFP_KERNEL);
2787 crypto_init_wait(&wait);
2789 if (vecs->public_key_vec)
2790 err = crypto_akcipher_set_pub_key(tfm, vecs->key,
2793 err = crypto_akcipher_set_priv_key(tfm, vecs->key,
2799 out_len_max = crypto_akcipher_maxsize(tfm);
2802 * First run test which do not require a private key, such as
2803 * encrypt or verify.
2805 outbuf_enc = kzalloc(out_len_max, GFP_KERNEL);
2809 if (!vecs->siggen_sigver_test) {
2811 m_size = vecs->m_size;
2813 c_size = vecs->c_size;
2816 /* Swap args so we could keep plaintext (digest)
2817 * in vecs->m, and cooked signature in vecs->c.
2819 m = vecs->c; /* signature */
2820 m_size = vecs->c_size;
2821 c = vecs->m; /* digest */
2822 c_size = vecs->m_size;
2826 if (WARN_ON(m_size > PAGE_SIZE))
2828 memcpy(xbuf[0], m, m_size);
2830 sg_init_table(src_tab, 2);
2831 sg_set_buf(&src_tab[0], xbuf[0], 8);
2832 sg_set_buf(&src_tab[1], xbuf[0] + 8, m_size - 8);
2833 sg_init_one(&dst, outbuf_enc, out_len_max);
2834 akcipher_request_set_crypt(req, src_tab, &dst, m_size,
2836 akcipher_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG,
2837 crypto_req_done, &wait);
2839 err = crypto_wait_req(vecs->siggen_sigver_test ?
2840 /* Run asymmetric signature verification */
2841 crypto_akcipher_verify(req) :
2842 /* Run asymmetric encrypt */
2843 crypto_akcipher_encrypt(req), &wait);
2845 pr_err("alg: akcipher: %s test failed. err %d\n", op, err);
2848 if (req->dst_len != c_size) {
2849 pr_err("alg: akcipher: %s test failed. Invalid output len\n",
2854 /* verify that encrypted message is equal to expected */
2855 if (memcmp(c, outbuf_enc, c_size)) {
2856 pr_err("alg: akcipher: %s test failed. Invalid output\n", op);
2857 hexdump(outbuf_enc, c_size);
2863 * Don't invoke (decrypt or sign) test which require a private key
2864 * for vectors with only a public key.
2866 if (vecs->public_key_vec) {
2870 outbuf_dec = kzalloc(out_len_max, GFP_KERNEL);
2876 op = vecs->siggen_sigver_test ? "sign" : "decrypt";
2877 if (WARN_ON(c_size > PAGE_SIZE))
2879 memcpy(xbuf[0], c, c_size);
2881 sg_init_one(&src, xbuf[0], c_size);
2882 sg_init_one(&dst, outbuf_dec, out_len_max);
2883 crypto_init_wait(&wait);
2884 akcipher_request_set_crypt(req, &src, &dst, c_size, out_len_max);
2886 err = crypto_wait_req(vecs->siggen_sigver_test ?
2887 /* Run asymmetric signature generation */
2888 crypto_akcipher_sign(req) :
2889 /* Run asymmetric decrypt */
2890 crypto_akcipher_decrypt(req), &wait);
2892 pr_err("alg: akcipher: %s test failed. err %d\n", op, err);
2895 out_len = req->dst_len;
2896 if (out_len < m_size) {
2897 pr_err("alg: akcipher: %s test failed. Invalid output len %u\n",
2902 /* verify that decrypted message is equal to the original msg */
2903 if (memchr_inv(outbuf_dec, 0, out_len - m_size) ||
2904 memcmp(m, outbuf_dec + out_len - m_size, m_size)) {
2905 pr_err("alg: akcipher: %s test failed. Invalid output\n", op);
2906 hexdump(outbuf_dec, out_len);
2913 akcipher_request_free(req);
2915 testmgr_free_buf(xbuf);
2919 static int test_akcipher(struct crypto_akcipher *tfm, const char *alg,
2920 const struct akcipher_testvec *vecs,
2921 unsigned int tcount)
2924 crypto_tfm_alg_driver_name(crypto_akcipher_tfm(tfm));
2927 for (i = 0; i < tcount; i++) {
2928 ret = test_akcipher_one(tfm, vecs++);
2932 pr_err("alg: akcipher: test %d failed for %s, err=%d\n",
2939 static int alg_test_akcipher(const struct alg_test_desc *desc,
2940 const char *driver, u32 type, u32 mask)
2942 struct crypto_akcipher *tfm;
2945 tfm = crypto_alloc_akcipher(driver, type, mask);
2947 pr_err("alg: akcipher: Failed to load tfm for %s: %ld\n",
2948 driver, PTR_ERR(tfm));
2949 return PTR_ERR(tfm);
2951 if (desc->suite.akcipher.vecs)
2952 err = test_akcipher(tfm, desc->alg, desc->suite.akcipher.vecs,
2953 desc->suite.akcipher.count);
2955 crypto_free_akcipher(tfm);
2959 static int alg_test_null(const struct alg_test_desc *desc,
2960 const char *driver, u32 type, u32 mask)
2965 #define __VECS(tv) { .vecs = tv, .count = ARRAY_SIZE(tv) }
2967 /* Please keep this list sorted by algorithm name. */
2968 static const struct alg_test_desc alg_test_descs[] = {
2970 .alg = "adiantum(xchacha12,aes)",
2971 .test = alg_test_skcipher,
2973 .cipher = __VECS(adiantum_xchacha12_aes_tv_template)
2976 .alg = "adiantum(xchacha20,aes)",
2977 .test = alg_test_skcipher,
2979 .cipher = __VECS(adiantum_xchacha20_aes_tv_template)
2983 .test = alg_test_aead,
2985 .aead = __VECS(aegis128_tv_template)
2989 .test = alg_test_aead,
2991 .aead = __VECS(aegis128l_tv_template)
2995 .test = alg_test_aead,
2997 .aead = __VECS(aegis256_tv_template)
3000 .alg = "ansi_cprng",
3001 .test = alg_test_cprng,
3003 .cprng = __VECS(ansi_cprng_aes_tv_template)
3006 .alg = "authenc(hmac(md5),ecb(cipher_null))",
3007 .test = alg_test_aead,
3009 .aead = __VECS(hmac_md5_ecb_cipher_null_tv_template)
3012 .alg = "authenc(hmac(sha1),cbc(aes))",
3013 .test = alg_test_aead,
3016 .aead = __VECS(hmac_sha1_aes_cbc_tv_temp)
3019 .alg = "authenc(hmac(sha1),cbc(des))",
3020 .test = alg_test_aead,
3022 .aead = __VECS(hmac_sha1_des_cbc_tv_temp)
3025 .alg = "authenc(hmac(sha1),cbc(des3_ede))",
3026 .test = alg_test_aead,
3029 .aead = __VECS(hmac_sha1_des3_ede_cbc_tv_temp)
3032 .alg = "authenc(hmac(sha1),ctr(aes))",
3033 .test = alg_test_null,
3036 .alg = "authenc(hmac(sha1),ecb(cipher_null))",
3037 .test = alg_test_aead,
3039 .aead = __VECS(hmac_sha1_ecb_cipher_null_tv_temp)
3042 .alg = "authenc(hmac(sha1),rfc3686(ctr(aes)))",
3043 .test = alg_test_null,
3046 .alg = "authenc(hmac(sha224),cbc(des))",
3047 .test = alg_test_aead,
3049 .aead = __VECS(hmac_sha224_des_cbc_tv_temp)
3052 .alg = "authenc(hmac(sha224),cbc(des3_ede))",
3053 .test = alg_test_aead,
3056 .aead = __VECS(hmac_sha224_des3_ede_cbc_tv_temp)
3059 .alg = "authenc(hmac(sha256),cbc(aes))",
3060 .test = alg_test_aead,
3063 .aead = __VECS(hmac_sha256_aes_cbc_tv_temp)
3066 .alg = "authenc(hmac(sha256),cbc(des))",
3067 .test = alg_test_aead,
3069 .aead = __VECS(hmac_sha256_des_cbc_tv_temp)
3072 .alg = "authenc(hmac(sha256),cbc(des3_ede))",
3073 .test = alg_test_aead,
3076 .aead = __VECS(hmac_sha256_des3_ede_cbc_tv_temp)
3079 .alg = "authenc(hmac(sha256),ctr(aes))",
3080 .test = alg_test_null,
3083 .alg = "authenc(hmac(sha256),rfc3686(ctr(aes)))",
3084 .test = alg_test_null,
3087 .alg = "authenc(hmac(sha384),cbc(des))",
3088 .test = alg_test_aead,
3090 .aead = __VECS(hmac_sha384_des_cbc_tv_temp)
3093 .alg = "authenc(hmac(sha384),cbc(des3_ede))",
3094 .test = alg_test_aead,
3097 .aead = __VECS(hmac_sha384_des3_ede_cbc_tv_temp)
3100 .alg = "authenc(hmac(sha384),ctr(aes))",
3101 .test = alg_test_null,
3104 .alg = "authenc(hmac(sha384),rfc3686(ctr(aes)))",
3105 .test = alg_test_null,
3108 .alg = "authenc(hmac(sha512),cbc(aes))",
3110 .test = alg_test_aead,
3112 .aead = __VECS(hmac_sha512_aes_cbc_tv_temp)
3115 .alg = "authenc(hmac(sha512),cbc(des))",
3116 .test = alg_test_aead,
3118 .aead = __VECS(hmac_sha512_des_cbc_tv_temp)
3121 .alg = "authenc(hmac(sha512),cbc(des3_ede))",
3122 .test = alg_test_aead,
3125 .aead = __VECS(hmac_sha512_des3_ede_cbc_tv_temp)
3128 .alg = "authenc(hmac(sha512),ctr(aes))",
3129 .test = alg_test_null,
3132 .alg = "authenc(hmac(sha512),rfc3686(ctr(aes)))",
3133 .test = alg_test_null,
3137 .test = alg_test_skcipher,
3140 .cipher = __VECS(aes_cbc_tv_template)
3143 .alg = "cbc(anubis)",
3144 .test = alg_test_skcipher,
3146 .cipher = __VECS(anubis_cbc_tv_template)
3149 .alg = "cbc(blowfish)",
3150 .test = alg_test_skcipher,
3152 .cipher = __VECS(bf_cbc_tv_template)
3155 .alg = "cbc(camellia)",
3156 .test = alg_test_skcipher,
3158 .cipher = __VECS(camellia_cbc_tv_template)
3161 .alg = "cbc(cast5)",
3162 .test = alg_test_skcipher,
3164 .cipher = __VECS(cast5_cbc_tv_template)
3167 .alg = "cbc(cast6)",
3168 .test = alg_test_skcipher,
3170 .cipher = __VECS(cast6_cbc_tv_template)
3174 .test = alg_test_skcipher,
3176 .cipher = __VECS(des_cbc_tv_template)
3179 .alg = "cbc(des3_ede)",
3180 .test = alg_test_skcipher,
3183 .cipher = __VECS(des3_ede_cbc_tv_template)
3186 /* Same as cbc(aes) except the key is stored in
3187 * hardware secure memory which we reference by index
3190 .test = alg_test_null,
3193 .alg = "cbc(serpent)",
3194 .test = alg_test_skcipher,
3196 .cipher = __VECS(serpent_cbc_tv_template)
3200 .test = alg_test_skcipher,
3202 .cipher = __VECS(sm4_cbc_tv_template)
3205 .alg = "cbc(twofish)",
3206 .test = alg_test_skcipher,
3208 .cipher = __VECS(tf_cbc_tv_template)
3211 .alg = "cbcmac(aes)",
3213 .test = alg_test_hash,
3215 .hash = __VECS(aes_cbcmac_tv_template)
3219 .test = alg_test_aead,
3222 .aead = __VECS(aes_ccm_tv_template)
3226 .test = alg_test_skcipher,
3229 .cipher = __VECS(aes_cfb_tv_template)
3233 .test = alg_test_skcipher,
3235 .cipher = __VECS(chacha20_tv_template)
3240 .test = alg_test_hash,
3242 .hash = __VECS(aes_cmac128_tv_template)
3245 .alg = "cmac(des3_ede)",
3247 .test = alg_test_hash,
3249 .hash = __VECS(des3_ede_cmac64_tv_template)
3252 .alg = "compress_null",
3253 .test = alg_test_null,
3256 .test = alg_test_hash,
3259 .hash = __VECS(crc32_tv_template)
3263 .test = alg_test_crc32c,
3266 .hash = __VECS(crc32c_tv_template)
3270 .test = alg_test_hash,
3273 .hash = __VECS(crct10dif_tv_template)
3277 .test = alg_test_skcipher,
3280 .cipher = __VECS(aes_ctr_tv_template)
3283 .alg = "ctr(blowfish)",
3284 .test = alg_test_skcipher,
3286 .cipher = __VECS(bf_ctr_tv_template)
3289 .alg = "ctr(camellia)",
3290 .test = alg_test_skcipher,
3292 .cipher = __VECS(camellia_ctr_tv_template)
3295 .alg = "ctr(cast5)",
3296 .test = alg_test_skcipher,
3298 .cipher = __VECS(cast5_ctr_tv_template)
3301 .alg = "ctr(cast6)",
3302 .test = alg_test_skcipher,
3304 .cipher = __VECS(cast6_ctr_tv_template)
3308 .test = alg_test_skcipher,
3310 .cipher = __VECS(des_ctr_tv_template)
3313 .alg = "ctr(des3_ede)",
3314 .test = alg_test_skcipher,
3317 .cipher = __VECS(des3_ede_ctr_tv_template)
3320 /* Same as ctr(aes) except the key is stored in
3321 * hardware secure memory which we reference by index
3324 .test = alg_test_null,
3327 .alg = "ctr(serpent)",
3328 .test = alg_test_skcipher,
3330 .cipher = __VECS(serpent_ctr_tv_template)
3334 .test = alg_test_skcipher,
3336 .cipher = __VECS(sm4_ctr_tv_template)
3339 .alg = "ctr(twofish)",
3340 .test = alg_test_skcipher,
3342 .cipher = __VECS(tf_ctr_tv_template)
3345 .alg = "cts(cbc(aes))",
3346 .test = alg_test_skcipher,
3349 .cipher = __VECS(cts_mode_tv_template)
3353 .test = alg_test_comp,
3357 .comp = __VECS(deflate_comp_tv_template),
3358 .decomp = __VECS(deflate_decomp_tv_template)
3363 .test = alg_test_kpp,
3366 .kpp = __VECS(dh_tv_template)
3369 .alg = "digest_null",
3370 .test = alg_test_null,
3372 .alg = "drbg_nopr_ctr_aes128",
3373 .test = alg_test_drbg,
3376 .drbg = __VECS(drbg_nopr_ctr_aes128_tv_template)
3379 .alg = "drbg_nopr_ctr_aes192",
3380 .test = alg_test_drbg,
3383 .drbg = __VECS(drbg_nopr_ctr_aes192_tv_template)
3386 .alg = "drbg_nopr_ctr_aes256",
3387 .test = alg_test_drbg,
3390 .drbg = __VECS(drbg_nopr_ctr_aes256_tv_template)
3394 * There is no need to specifically test the DRBG with every
3395 * backend cipher -- covered by drbg_nopr_hmac_sha256 test
3397 .alg = "drbg_nopr_hmac_sha1",
3399 .test = alg_test_null,
3401 .alg = "drbg_nopr_hmac_sha256",
3402 .test = alg_test_drbg,
3405 .drbg = __VECS(drbg_nopr_hmac_sha256_tv_template)
3408 /* covered by drbg_nopr_hmac_sha256 test */
3409 .alg = "drbg_nopr_hmac_sha384",
3411 .test = alg_test_null,
3413 .alg = "drbg_nopr_hmac_sha512",
3414 .test = alg_test_null,
3417 .alg = "drbg_nopr_sha1",
3419 .test = alg_test_null,
3421 .alg = "drbg_nopr_sha256",
3422 .test = alg_test_drbg,
3425 .drbg = __VECS(drbg_nopr_sha256_tv_template)
3428 /* covered by drbg_nopr_sha256 test */
3429 .alg = "drbg_nopr_sha384",
3431 .test = alg_test_null,
3433 .alg = "drbg_nopr_sha512",
3435 .test = alg_test_null,
3437 .alg = "drbg_pr_ctr_aes128",
3438 .test = alg_test_drbg,
3441 .drbg = __VECS(drbg_pr_ctr_aes128_tv_template)
3444 /* covered by drbg_pr_ctr_aes128 test */
3445 .alg = "drbg_pr_ctr_aes192",
3447 .test = alg_test_null,
3449 .alg = "drbg_pr_ctr_aes256",
3451 .test = alg_test_null,
3453 .alg = "drbg_pr_hmac_sha1",
3455 .test = alg_test_null,
3457 .alg = "drbg_pr_hmac_sha256",
3458 .test = alg_test_drbg,
3461 .drbg = __VECS(drbg_pr_hmac_sha256_tv_template)
3464 /* covered by drbg_pr_hmac_sha256 test */
3465 .alg = "drbg_pr_hmac_sha384",
3467 .test = alg_test_null,
3469 .alg = "drbg_pr_hmac_sha512",
3470 .test = alg_test_null,
3473 .alg = "drbg_pr_sha1",
3475 .test = alg_test_null,
3477 .alg = "drbg_pr_sha256",
3478 .test = alg_test_drbg,
3481 .drbg = __VECS(drbg_pr_sha256_tv_template)
3484 /* covered by drbg_pr_sha256 test */
3485 .alg = "drbg_pr_sha384",
3487 .test = alg_test_null,
3489 .alg = "drbg_pr_sha512",
3491 .test = alg_test_null,
3494 .test = alg_test_skcipher,
3497 .cipher = __VECS(aes_tv_template)
3500 .alg = "ecb(anubis)",
3501 .test = alg_test_skcipher,
3503 .cipher = __VECS(anubis_tv_template)
3507 .test = alg_test_skcipher,
3509 .cipher = __VECS(arc4_tv_template)
3512 .alg = "ecb(blowfish)",
3513 .test = alg_test_skcipher,
3515 .cipher = __VECS(bf_tv_template)
3518 .alg = "ecb(camellia)",
3519 .test = alg_test_skcipher,
3521 .cipher = __VECS(camellia_tv_template)
3524 .alg = "ecb(cast5)",
3525 .test = alg_test_skcipher,
3527 .cipher = __VECS(cast5_tv_template)
3530 .alg = "ecb(cast6)",
3531 .test = alg_test_skcipher,
3533 .cipher = __VECS(cast6_tv_template)
3536 .alg = "ecb(cipher_null)",
3537 .test = alg_test_null,
3541 .test = alg_test_skcipher,
3543 .cipher = __VECS(des_tv_template)
3546 .alg = "ecb(des3_ede)",
3547 .test = alg_test_skcipher,
3550 .cipher = __VECS(des3_ede_tv_template)
3553 .alg = "ecb(fcrypt)",
3554 .test = alg_test_skcipher,
3557 .vecs = fcrypt_pcbc_tv_template,
3562 .alg = "ecb(khazad)",
3563 .test = alg_test_skcipher,
3565 .cipher = __VECS(khazad_tv_template)
3568 /* Same as ecb(aes) except the key is stored in
3569 * hardware secure memory which we reference by index
3572 .test = alg_test_null,
3576 .test = alg_test_skcipher,
3578 .cipher = __VECS(seed_tv_template)
3581 .alg = "ecb(serpent)",
3582 .test = alg_test_skcipher,
3584 .cipher = __VECS(serpent_tv_template)
3588 .test = alg_test_skcipher,
3590 .cipher = __VECS(sm4_tv_template)
3594 .test = alg_test_skcipher,
3596 .cipher = __VECS(tea_tv_template)
3599 .alg = "ecb(tnepres)",
3600 .test = alg_test_skcipher,
3602 .cipher = __VECS(tnepres_tv_template)
3605 .alg = "ecb(twofish)",
3606 .test = alg_test_skcipher,
3608 .cipher = __VECS(tf_tv_template)
3612 .test = alg_test_skcipher,
3614 .cipher = __VECS(xeta_tv_template)
3618 .test = alg_test_skcipher,
3620 .cipher = __VECS(xtea_tv_template)
3624 .test = alg_test_kpp,
3627 .kpp = __VECS(ecdh_tv_template)
3631 .test = alg_test_aead,
3634 .aead = __VECS(aes_gcm_tv_template)
3638 .test = alg_test_hash,
3641 .hash = __VECS(ghash_tv_template)
3645 .test = alg_test_hash,
3647 .hash = __VECS(hmac_md5_tv_template)
3650 .alg = "hmac(rmd128)",
3651 .test = alg_test_hash,
3653 .hash = __VECS(hmac_rmd128_tv_template)
3656 .alg = "hmac(rmd160)",
3657 .test = alg_test_hash,
3659 .hash = __VECS(hmac_rmd160_tv_template)
3662 .alg = "hmac(sha1)",
3663 .test = alg_test_hash,
3666 .hash = __VECS(hmac_sha1_tv_template)
3669 .alg = "hmac(sha224)",
3670 .test = alg_test_hash,
3673 .hash = __VECS(hmac_sha224_tv_template)
3676 .alg = "hmac(sha256)",
3677 .test = alg_test_hash,
3680 .hash = __VECS(hmac_sha256_tv_template)
3683 .alg = "hmac(sha3-224)",
3684 .test = alg_test_hash,
3687 .hash = __VECS(hmac_sha3_224_tv_template)
3690 .alg = "hmac(sha3-256)",
3691 .test = alg_test_hash,
3694 .hash = __VECS(hmac_sha3_256_tv_template)
3697 .alg = "hmac(sha3-384)",
3698 .test = alg_test_hash,
3701 .hash = __VECS(hmac_sha3_384_tv_template)
3704 .alg = "hmac(sha3-512)",
3705 .test = alg_test_hash,
3708 .hash = __VECS(hmac_sha3_512_tv_template)
3711 .alg = "hmac(sha384)",
3712 .test = alg_test_hash,
3715 .hash = __VECS(hmac_sha384_tv_template)
3718 .alg = "hmac(sha512)",
3719 .test = alg_test_hash,
3722 .hash = __VECS(hmac_sha512_tv_template)
3725 .alg = "hmac(streebog256)",
3726 .test = alg_test_hash,
3728 .hash = __VECS(hmac_streebog256_tv_template)
3731 .alg = "hmac(streebog512)",
3732 .test = alg_test_hash,
3734 .hash = __VECS(hmac_streebog512_tv_template)
3737 .alg = "jitterentropy_rng",
3739 .test = alg_test_null,
3742 .test = alg_test_skcipher,
3745 .cipher = __VECS(aes_kw_tv_template)
3749 .test = alg_test_skcipher,
3751 .cipher = __VECS(aes_lrw_tv_template)
3754 .alg = "lrw(camellia)",
3755 .test = alg_test_skcipher,
3757 .cipher = __VECS(camellia_lrw_tv_template)
3760 .alg = "lrw(cast6)",
3761 .test = alg_test_skcipher,
3763 .cipher = __VECS(cast6_lrw_tv_template)
3766 .alg = "lrw(serpent)",
3767 .test = alg_test_skcipher,
3769 .cipher = __VECS(serpent_lrw_tv_template)
3772 .alg = "lrw(twofish)",
3773 .test = alg_test_skcipher,
3775 .cipher = __VECS(tf_lrw_tv_template)
3779 .test = alg_test_comp,
3783 .comp = __VECS(lz4_comp_tv_template),
3784 .decomp = __VECS(lz4_decomp_tv_template)
3789 .test = alg_test_comp,
3793 .comp = __VECS(lz4hc_comp_tv_template),
3794 .decomp = __VECS(lz4hc_decomp_tv_template)
3799 .test = alg_test_comp,
3803 .comp = __VECS(lzo_comp_tv_template),
3804 .decomp = __VECS(lzo_decomp_tv_template)
3809 .test = alg_test_hash,
3811 .hash = __VECS(md4_tv_template)
3815 .test = alg_test_hash,
3817 .hash = __VECS(md5_tv_template)
3820 .alg = "michael_mic",
3821 .test = alg_test_hash,
3823 .hash = __VECS(michael_mic_tv_template)
3827 .test = alg_test_aead,
3829 .aead = __VECS(morus1280_tv_template)
3833 .test = alg_test_aead,
3835 .aead = __VECS(morus640_tv_template)
3838 .alg = "nhpoly1305",
3839 .test = alg_test_hash,
3841 .hash = __VECS(nhpoly1305_tv_template)
3845 .test = alg_test_skcipher,
3848 .cipher = __VECS(aes_ofb_tv_template)
3851 /* Same as ofb(aes) except the key is stored in
3852 * hardware secure memory which we reference by index
3855 .test = alg_test_null,
3858 .alg = "pcbc(fcrypt)",
3859 .test = alg_test_skcipher,
3861 .cipher = __VECS(fcrypt_pcbc_tv_template)
3864 .alg = "pkcs1pad(rsa,sha224)",
3865 .test = alg_test_null,
3868 .alg = "pkcs1pad(rsa,sha256)",
3869 .test = alg_test_akcipher,
3872 .akcipher = __VECS(pkcs1pad_rsa_tv_template)
3875 .alg = "pkcs1pad(rsa,sha384)",
3876 .test = alg_test_null,
3879 .alg = "pkcs1pad(rsa,sha512)",
3880 .test = alg_test_null,
3884 .test = alg_test_hash,
3886 .hash = __VECS(poly1305_tv_template)
3889 .alg = "rfc3686(ctr(aes))",
3890 .test = alg_test_skcipher,
3893 .cipher = __VECS(aes_ctr_rfc3686_tv_template)
3896 .alg = "rfc4106(gcm(aes))",
3897 .test = alg_test_aead,
3900 .aead = __VECS(aes_gcm_rfc4106_tv_template)
3903 .alg = "rfc4309(ccm(aes))",
3904 .test = alg_test_aead,
3907 .aead = __VECS(aes_ccm_rfc4309_tv_template)
3910 .alg = "rfc4543(gcm(aes))",
3911 .test = alg_test_aead,
3913 .aead = __VECS(aes_gcm_rfc4543_tv_template)
3916 .alg = "rfc7539(chacha20,poly1305)",
3917 .test = alg_test_aead,
3919 .aead = __VECS(rfc7539_tv_template)
3922 .alg = "rfc7539esp(chacha20,poly1305)",
3923 .test = alg_test_aead,
3925 .aead = __VECS(rfc7539esp_tv_template)
3929 .test = alg_test_hash,
3931 .hash = __VECS(rmd128_tv_template)
3935 .test = alg_test_hash,
3937 .hash = __VECS(rmd160_tv_template)
3941 .test = alg_test_hash,
3943 .hash = __VECS(rmd256_tv_template)
3947 .test = alg_test_hash,
3949 .hash = __VECS(rmd320_tv_template)
3953 .test = alg_test_akcipher,
3956 .akcipher = __VECS(rsa_tv_template)
3960 .test = alg_test_skcipher,
3962 .cipher = __VECS(salsa20_stream_tv_template)
3966 .test = alg_test_hash,
3969 .hash = __VECS(sha1_tv_template)
3973 .test = alg_test_hash,
3976 .hash = __VECS(sha224_tv_template)
3980 .test = alg_test_hash,
3983 .hash = __VECS(sha256_tv_template)
3987 .test = alg_test_hash,
3990 .hash = __VECS(sha3_224_tv_template)
3994 .test = alg_test_hash,
3997 .hash = __VECS(sha3_256_tv_template)
4001 .test = alg_test_hash,
4004 .hash = __VECS(sha3_384_tv_template)
4008 .test = alg_test_hash,
4011 .hash = __VECS(sha3_512_tv_template)
4015 .test = alg_test_hash,
4018 .hash = __VECS(sha384_tv_template)
4022 .test = alg_test_hash,
4025 .hash = __VECS(sha512_tv_template)
4029 .test = alg_test_hash,
4031 .hash = __VECS(sm3_tv_template)
4034 .alg = "streebog256",
4035 .test = alg_test_hash,
4037 .hash = __VECS(streebog256_tv_template)
4040 .alg = "streebog512",
4041 .test = alg_test_hash,
4043 .hash = __VECS(streebog512_tv_template)
4047 .test = alg_test_hash,
4049 .hash = __VECS(tgr128_tv_template)
4053 .test = alg_test_hash,
4055 .hash = __VECS(tgr160_tv_template)
4059 .test = alg_test_hash,
4061 .hash = __VECS(tgr192_tv_template)
4064 .alg = "vmac64(aes)",
4065 .test = alg_test_hash,
4067 .hash = __VECS(vmac64_aes_tv_template)
4071 .test = alg_test_hash,
4073 .hash = __VECS(wp256_tv_template)
4077 .test = alg_test_hash,
4079 .hash = __VECS(wp384_tv_template)
4083 .test = alg_test_hash,
4085 .hash = __VECS(wp512_tv_template)
4089 .test = alg_test_hash,
4091 .hash = __VECS(aes_xcbc128_tv_template)
4095 .test = alg_test_skcipher,
4097 .cipher = __VECS(xchacha12_tv_template)
4101 .test = alg_test_skcipher,
4103 .cipher = __VECS(xchacha20_tv_template)
4107 .test = alg_test_skcipher,
4110 .cipher = __VECS(aes_xts_tv_template)
4113 .alg = "xts(camellia)",
4114 .test = alg_test_skcipher,
4116 .cipher = __VECS(camellia_xts_tv_template)
4119 .alg = "xts(cast6)",
4120 .test = alg_test_skcipher,
4122 .cipher = __VECS(cast6_xts_tv_template)
4125 /* Same as xts(aes) except the key is stored in
4126 * hardware secure memory which we reference by index
4129 .test = alg_test_null,
4132 .alg = "xts(serpent)",
4133 .test = alg_test_skcipher,
4135 .cipher = __VECS(serpent_xts_tv_template)
4138 .alg = "xts(twofish)",
4139 .test = alg_test_skcipher,
4141 .cipher = __VECS(tf_xts_tv_template)
4144 .alg = "xts4096(paes)",
4145 .test = alg_test_null,
4148 .alg = "xts512(paes)",
4149 .test = alg_test_null,
4152 .alg = "zlib-deflate",
4153 .test = alg_test_comp,
4157 .comp = __VECS(zlib_deflate_comp_tv_template),
4158 .decomp = __VECS(zlib_deflate_decomp_tv_template)
4163 .test = alg_test_comp,
4167 .comp = __VECS(zstd_comp_tv_template),
4168 .decomp = __VECS(zstd_decomp_tv_template)
4174 static void alg_check_test_descs_order(void)
4178 for (i = 1; i < ARRAY_SIZE(alg_test_descs); i++) {
4179 int diff = strcmp(alg_test_descs[i - 1].alg,
4180 alg_test_descs[i].alg);
4182 if (WARN_ON(diff > 0)) {
4183 pr_warn("testmgr: alg_test_descs entries in wrong order: '%s' before '%s'\n",
4184 alg_test_descs[i - 1].alg,
4185 alg_test_descs[i].alg);
4188 if (WARN_ON(diff == 0)) {
4189 pr_warn("testmgr: duplicate alg_test_descs entry: '%s'\n",
4190 alg_test_descs[i].alg);
4195 static void alg_check_testvec_configs(void)
4199 for (i = 0; i < ARRAY_SIZE(default_cipher_testvec_configs); i++)
4200 WARN_ON(!valid_testvec_config(
4201 &default_cipher_testvec_configs[i]));
4204 static void testmgr_onetime_init(void)
4206 alg_check_test_descs_order();
4207 alg_check_testvec_configs();
4209 #ifdef CONFIG_CRYPTO_MANAGER_EXTRA_TESTS
4210 pr_warn("alg: extra crypto tests enabled. This is intended for developer use only.\n");
4214 static int alg_find_test(const char *alg)
4217 int end = ARRAY_SIZE(alg_test_descs);
4219 while (start < end) {
4220 int i = (start + end) / 2;
4221 int diff = strcmp(alg_test_descs[i].alg, alg);
4239 int alg_test(const char *driver, const char *alg, u32 type, u32 mask)
4245 if (!fips_enabled && notests) {
4246 printk_once(KERN_INFO "alg: self-tests disabled\n");
4250 DO_ONCE(testmgr_onetime_init);
4252 if ((type & CRYPTO_ALG_TYPE_MASK) == CRYPTO_ALG_TYPE_CIPHER) {
4253 char nalg[CRYPTO_MAX_ALG_NAME];
4255 if (snprintf(nalg, sizeof(nalg), "ecb(%s)", alg) >=
4257 return -ENAMETOOLONG;
4259 i = alg_find_test(nalg);
4263 if (fips_enabled && !alg_test_descs[i].fips_allowed)
4266 rc = alg_test_cipher(alg_test_descs + i, driver, type, mask);
4270 i = alg_find_test(alg);
4271 j = alg_find_test(driver);
4275 if (fips_enabled && ((i >= 0 && !alg_test_descs[i].fips_allowed) ||
4276 (j >= 0 && !alg_test_descs[j].fips_allowed)))
4281 rc |= alg_test_descs[i].test(alg_test_descs + i, driver,
4283 if (j >= 0 && j != i)
4284 rc |= alg_test_descs[j].test(alg_test_descs + j, driver,
4288 if (fips_enabled && rc)
4289 panic("%s: %s alg self test failed in fips mode!\n", driver, alg);
4291 if (fips_enabled && !rc)
4292 pr_info("alg: self-tests for %s (%s) passed\n", driver, alg);
4297 printk(KERN_INFO "alg: No test for %s (%s)\n", alg, driver);
4303 #endif /* CONFIG_CRYPTO_MANAGER_DISABLE_TESTS */
4305 EXPORT_SYMBOL_GPL(alg_test);