1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * Algorithm testing framework and tests. 4 * 5 * Copyright (c) 2002 James Morris <jmorris@intercode.com.au> 6 * Copyright (c) 2002 Jean-Francois Dive <jef@linuxbe.org> 7 * Copyright (c) 2007 Nokia Siemens Networks 8 * Copyright (c) 2008 Herbert Xu <herbert@gondor.apana.org.au> 9 * Copyright (c) 2019 Google LLC 10 * 11 * Updated RFC4106 AES-GCM testing. 12 * Authors: Aidan O'Mahony (aidan.o.mahony@intel.com) 13 * Adrian Hoban <adrian.hoban@intel.com> 14 * Gabriele Paoloni <gabriele.paoloni@intel.com> 15 * Tadeusz Struk (tadeusz.struk@intel.com) 16 * Copyright (c) 2010, Intel Corporation. 17 */ 18 19 #include <crypto/aead.h> 20 #include <crypto/hash.h> 21 #include <crypto/skcipher.h> 22 #include <linux/err.h> 23 #include <linux/fips.h> 24 #include <linux/module.h> 25 #include <linux/once.h> 26 #include <linux/random.h> 27 #include <linux/scatterlist.h> 28 #include <linux/slab.h> 29 #include <linux/string.h> 30 #include <linux/uio.h> 31 #include <crypto/rng.h> 32 #include <crypto/drbg.h> 33 #include <crypto/akcipher.h> 34 #include <crypto/kpp.h> 35 #include <crypto/acompress.h> 36 #include <crypto/internal/simd.h> 37 38 #include "internal.h" 39 40 static bool notests; 41 module_param(notests, bool, 0644); 42 MODULE_PARM_DESC(notests, "disable crypto self-tests"); 43 44 static bool panic_on_fail; 45 module_param(panic_on_fail, bool, 0444); 46 47 #ifdef CONFIG_CRYPTO_MANAGER_EXTRA_TESTS 48 static bool noextratests; 49 module_param(noextratests, bool, 0644); 50 MODULE_PARM_DESC(noextratests, "disable expensive crypto self-tests"); 51 52 static unsigned int fuzz_iterations = 100; 53 module_param(fuzz_iterations, uint, 0644); 54 MODULE_PARM_DESC(fuzz_iterations, "number of fuzz test iterations"); 55 56 DEFINE_PER_CPU(bool, crypto_simd_disabled_for_test); 57 EXPORT_PER_CPU_SYMBOL_GPL(crypto_simd_disabled_for_test); 58 #endif 59 60 #ifdef CONFIG_CRYPTO_MANAGER_DISABLE_TESTS 61 62 /* a perfect nop */ 63 int alg_test(const char *driver, const char *alg, u32 type, u32 mask) 64 { 65 return 0; 66 } 67 68 #else 69 70 #include "testmgr.h" 71 72 /* 73 * Need slab memory for testing (size in number of pages). 74 */ 75 #define XBUFSIZE 8 76 77 /* 78 * Used by test_cipher() 79 */ 80 #define ENCRYPT 1 81 #define DECRYPT 0 82 83 struct aead_test_suite { 84 const struct aead_testvec *vecs; 85 unsigned int count; 86 87 /* 88 * Set if trying to decrypt an inauthentic ciphertext with this 89 * algorithm might result in EINVAL rather than EBADMSG, due to other 90 * validation the algorithm does on the inputs such as length checks. 91 */ 92 unsigned int einval_allowed : 1; 93 94 /* 95 * Set if this algorithm requires that the IV be located at the end of 96 * the AAD buffer, in addition to being given in the normal way. The 97 * behavior when the two IV copies differ is implementation-defined. 98 */ 99 unsigned int aad_iv : 1; 100 }; 101 102 struct cipher_test_suite { 103 const struct cipher_testvec *vecs; 104 unsigned int count; 105 }; 106 107 struct comp_test_suite { 108 struct { 109 const struct comp_testvec *vecs; 110 unsigned int count; 111 } comp, decomp; 112 }; 113 114 struct hash_test_suite { 115 const struct hash_testvec *vecs; 116 unsigned int count; 117 }; 118 119 struct cprng_test_suite { 120 const struct cprng_testvec *vecs; 121 unsigned int count; 122 }; 123 124 struct drbg_test_suite { 125 const struct drbg_testvec *vecs; 126 unsigned int count; 127 }; 128 129 struct akcipher_test_suite { 130 const struct akcipher_testvec *vecs; 131 unsigned int count; 132 }; 133 134 struct kpp_test_suite { 135 const struct kpp_testvec *vecs; 136 unsigned int count; 137 }; 138 139 struct alg_test_desc { 140 const char *alg; 141 const char *generic_driver; 142 int (*test)(const struct alg_test_desc *desc, const char *driver, 143 u32 type, u32 mask); 144 int fips_allowed; /* set if alg is allowed in fips mode */ 145 146 union { 147 struct aead_test_suite aead; 148 struct cipher_test_suite cipher; 149 struct comp_test_suite comp; 150 struct hash_test_suite hash; 151 struct cprng_test_suite cprng; 152 struct drbg_test_suite drbg; 153 struct akcipher_test_suite akcipher; 154 struct kpp_test_suite kpp; 155 } suite; 156 }; 157 158 static void hexdump(unsigned char *buf, unsigned int len) 159 { 160 print_hex_dump(KERN_CONT, "", DUMP_PREFIX_OFFSET, 161 16, 1, 162 buf, len, false); 163 } 164 165 static int __testmgr_alloc_buf(char *buf[XBUFSIZE], int order) 166 { 167 int i; 168 169 for (i = 0; i < XBUFSIZE; i++) { 170 buf[i] = (char *)__get_free_pages(GFP_KERNEL, order); 171 if (!buf[i]) 172 goto err_free_buf; 173 } 174 175 return 0; 176 177 err_free_buf: 178 while (i-- > 0) 179 free_pages((unsigned long)buf[i], order); 180 181 return -ENOMEM; 182 } 183 184 static int testmgr_alloc_buf(char *buf[XBUFSIZE]) 185 { 186 return __testmgr_alloc_buf(buf, 0); 187 } 188 189 static void __testmgr_free_buf(char *buf[XBUFSIZE], int order) 190 { 191 int i; 192 193 for (i = 0; i < XBUFSIZE; i++) 194 free_pages((unsigned long)buf[i], order); 195 } 196 197 static void testmgr_free_buf(char *buf[XBUFSIZE]) 198 { 199 __testmgr_free_buf(buf, 0); 200 } 201 202 #define TESTMGR_POISON_BYTE 0xfe 203 #define TESTMGR_POISON_LEN 16 204 205 static inline void testmgr_poison(void *addr, size_t len) 206 { 207 memset(addr, TESTMGR_POISON_BYTE, len); 208 } 209 210 /* Is the memory region still fully poisoned? */ 211 static inline bool testmgr_is_poison(const void *addr, size_t len) 212 { 213 return memchr_inv(addr, TESTMGR_POISON_BYTE, len) == NULL; 214 } 215 216 /* flush type for hash algorithms */ 217 enum flush_type { 218 /* merge with update of previous buffer(s) */ 219 FLUSH_TYPE_NONE = 0, 220 221 /* update with previous buffer(s) before doing this one */ 222 FLUSH_TYPE_FLUSH, 223 224 /* likewise, but also export and re-import the intermediate state */ 225 FLUSH_TYPE_REIMPORT, 226 }; 227 228 /* finalization function for hash algorithms */ 229 enum finalization_type { 230 FINALIZATION_TYPE_FINAL, /* use final() */ 231 FINALIZATION_TYPE_FINUP, /* use finup() */ 232 FINALIZATION_TYPE_DIGEST, /* use digest() */ 233 }; 234 235 #define TEST_SG_TOTAL 10000 236 237 /** 238 * struct test_sg_division - description of a scatterlist entry 239 * 240 * This struct describes one entry of a scatterlist being constructed to check a 241 * crypto test vector. 242 * 243 * @proportion_of_total: length of this chunk relative to the total length, 244 * given as a proportion out of TEST_SG_TOTAL so that it 245 * scales to fit any test vector 246 * @offset: byte offset into a 2-page buffer at which this chunk will start 247 * @offset_relative_to_alignmask: if true, add the algorithm's alignmask to the 248 * @offset 249 * @flush_type: for hashes, whether an update() should be done now vs. 250 * continuing to accumulate data 251 * @nosimd: if doing the pending update(), do it with SIMD disabled? 252 */ 253 struct test_sg_division { 254 unsigned int proportion_of_total; 255 unsigned int offset; 256 bool offset_relative_to_alignmask; 257 enum flush_type flush_type; 258 bool nosimd; 259 }; 260 261 /** 262 * struct testvec_config - configuration for testing a crypto test vector 263 * 264 * This struct describes the data layout and other parameters with which each 265 * crypto test vector can be tested. 266 * 267 * @name: name of this config, logged for debugging purposes if a test fails 268 * @inplace: operate on the data in-place, if applicable for the algorithm type? 269 * @req_flags: extra request_flags, e.g. CRYPTO_TFM_REQ_MAY_SLEEP 270 * @src_divs: description of how to arrange the source scatterlist 271 * @dst_divs: description of how to arrange the dst scatterlist, if applicable 272 * for the algorithm type. Defaults to @src_divs if unset. 273 * @iv_offset: misalignment of the IV in the range [0..MAX_ALGAPI_ALIGNMASK+1], 274 * where 0 is aligned to a 2*(MAX_ALGAPI_ALIGNMASK+1) byte boundary 275 * @iv_offset_relative_to_alignmask: if true, add the algorithm's alignmask to 276 * the @iv_offset 277 * @key_offset: misalignment of the key, where 0 is default alignment 278 * @key_offset_relative_to_alignmask: if true, add the algorithm's alignmask to 279 * the @key_offset 280 * @finalization_type: what finalization function to use for hashes 281 * @nosimd: execute with SIMD disabled? Requires !CRYPTO_TFM_REQ_MAY_SLEEP. 282 */ 283 struct testvec_config { 284 const char *name; 285 bool inplace; 286 u32 req_flags; 287 struct test_sg_division src_divs[XBUFSIZE]; 288 struct test_sg_division dst_divs[XBUFSIZE]; 289 unsigned int iv_offset; 290 unsigned int key_offset; 291 bool iv_offset_relative_to_alignmask; 292 bool key_offset_relative_to_alignmask; 293 enum finalization_type finalization_type; 294 bool nosimd; 295 }; 296 297 #define TESTVEC_CONFIG_NAMELEN 192 298 299 /* 300 * The following are the lists of testvec_configs to test for each algorithm 301 * type when the basic crypto self-tests are enabled, i.e. when 302 * CONFIG_CRYPTO_MANAGER_DISABLE_TESTS is unset. They aim to provide good test 303 * coverage, while keeping the test time much shorter than the full fuzz tests 304 * so that the basic tests can be enabled in a wider range of circumstances. 305 */ 306 307 /* Configs for skciphers and aeads */ 308 static const struct testvec_config default_cipher_testvec_configs[] = { 309 { 310 .name = "in-place", 311 .inplace = true, 312 .src_divs = { { .proportion_of_total = 10000 } }, 313 }, { 314 .name = "out-of-place", 315 .src_divs = { { .proportion_of_total = 10000 } }, 316 }, { 317 .name = "unaligned buffer, offset=1", 318 .src_divs = { { .proportion_of_total = 10000, .offset = 1 } }, 319 .iv_offset = 1, 320 .key_offset = 1, 321 }, { 322 .name = "buffer aligned only to alignmask", 323 .src_divs = { 324 { 325 .proportion_of_total = 10000, 326 .offset = 1, 327 .offset_relative_to_alignmask = true, 328 }, 329 }, 330 .iv_offset = 1, 331 .iv_offset_relative_to_alignmask = true, 332 .key_offset = 1, 333 .key_offset_relative_to_alignmask = true, 334 }, { 335 .name = "two even aligned splits", 336 .src_divs = { 337 { .proportion_of_total = 5000 }, 338 { .proportion_of_total = 5000 }, 339 }, 340 }, { 341 .name = "uneven misaligned splits, may sleep", 342 .req_flags = CRYPTO_TFM_REQ_MAY_SLEEP, 343 .src_divs = { 344 { .proportion_of_total = 1900, .offset = 33 }, 345 { .proportion_of_total = 3300, .offset = 7 }, 346 { .proportion_of_total = 4800, .offset = 18 }, 347 }, 348 .iv_offset = 3, 349 .key_offset = 3, 350 }, { 351 .name = "misaligned splits crossing pages, inplace", 352 .inplace = true, 353 .src_divs = { 354 { 355 .proportion_of_total = 7500, 356 .offset = PAGE_SIZE - 32 357 }, { 358 .proportion_of_total = 2500, 359 .offset = PAGE_SIZE - 7 360 }, 361 }, 362 } 363 }; 364 365 static const struct testvec_config default_hash_testvec_configs[] = { 366 { 367 .name = "init+update+final aligned buffer", 368 .src_divs = { { .proportion_of_total = 10000 } }, 369 .finalization_type = FINALIZATION_TYPE_FINAL, 370 }, { 371 .name = "init+finup aligned buffer", 372 .src_divs = { { .proportion_of_total = 10000 } }, 373 .finalization_type = FINALIZATION_TYPE_FINUP, 374 }, { 375 .name = "digest aligned buffer", 376 .src_divs = { { .proportion_of_total = 10000 } }, 377 .finalization_type = FINALIZATION_TYPE_DIGEST, 378 }, { 379 .name = "init+update+final misaligned buffer", 380 .src_divs = { { .proportion_of_total = 10000, .offset = 1 } }, 381 .finalization_type = FINALIZATION_TYPE_FINAL, 382 .key_offset = 1, 383 }, { 384 .name = "digest buffer aligned only to alignmask", 385 .src_divs = { 386 { 387 .proportion_of_total = 10000, 388 .offset = 1, 389 .offset_relative_to_alignmask = true, 390 }, 391 }, 392 .finalization_type = FINALIZATION_TYPE_DIGEST, 393 .key_offset = 1, 394 .key_offset_relative_to_alignmask = true, 395 }, { 396 .name = "init+update+update+final two even splits", 397 .src_divs = { 398 { .proportion_of_total = 5000 }, 399 { 400 .proportion_of_total = 5000, 401 .flush_type = FLUSH_TYPE_FLUSH, 402 }, 403 }, 404 .finalization_type = FINALIZATION_TYPE_FINAL, 405 }, { 406 .name = "digest uneven misaligned splits, may sleep", 407 .req_flags = CRYPTO_TFM_REQ_MAY_SLEEP, 408 .src_divs = { 409 { .proportion_of_total = 1900, .offset = 33 }, 410 { .proportion_of_total = 3300, .offset = 7 }, 411 { .proportion_of_total = 4800, .offset = 18 }, 412 }, 413 .finalization_type = FINALIZATION_TYPE_DIGEST, 414 }, { 415 .name = "digest misaligned splits crossing pages", 416 .src_divs = { 417 { 418 .proportion_of_total = 7500, 419 .offset = PAGE_SIZE - 32, 420 }, { 421 .proportion_of_total = 2500, 422 .offset = PAGE_SIZE - 7, 423 }, 424 }, 425 .finalization_type = FINALIZATION_TYPE_DIGEST, 426 }, { 427 .name = "import/export", 428 .src_divs = { 429 { 430 .proportion_of_total = 6500, 431 .flush_type = FLUSH_TYPE_REIMPORT, 432 }, { 433 .proportion_of_total = 3500, 434 .flush_type = FLUSH_TYPE_REIMPORT, 435 }, 436 }, 437 .finalization_type = FINALIZATION_TYPE_FINAL, 438 } 439 }; 440 441 static unsigned int count_test_sg_divisions(const struct test_sg_division *divs) 442 { 443 unsigned int remaining = TEST_SG_TOTAL; 444 unsigned int ndivs = 0; 445 446 do { 447 remaining -= divs[ndivs++].proportion_of_total; 448 } while (remaining); 449 450 return ndivs; 451 } 452 453 #define SGDIVS_HAVE_FLUSHES BIT(0) 454 #define SGDIVS_HAVE_NOSIMD BIT(1) 455 456 static bool valid_sg_divisions(const struct test_sg_division *divs, 457 unsigned int count, int *flags_ret) 458 { 459 unsigned int total = 0; 460 unsigned int i; 461 462 for (i = 0; i < count && total != TEST_SG_TOTAL; i++) { 463 if (divs[i].proportion_of_total <= 0 || 464 divs[i].proportion_of_total > TEST_SG_TOTAL - total) 465 return false; 466 total += divs[i].proportion_of_total; 467 if (divs[i].flush_type != FLUSH_TYPE_NONE) 468 *flags_ret |= SGDIVS_HAVE_FLUSHES; 469 if (divs[i].nosimd) 470 *flags_ret |= SGDIVS_HAVE_NOSIMD; 471 } 472 return total == TEST_SG_TOTAL && 473 memchr_inv(&divs[i], 0, (count - i) * sizeof(divs[0])) == NULL; 474 } 475 476 /* 477 * Check whether the given testvec_config is valid. This isn't strictly needed 478 * since every testvec_config should be valid, but check anyway so that people 479 * don't unknowingly add broken configs that don't do what they wanted. 480 */ 481 static bool valid_testvec_config(const struct testvec_config *cfg) 482 { 483 int flags = 0; 484 485 if (cfg->name == NULL) 486 return false; 487 488 if (!valid_sg_divisions(cfg->src_divs, ARRAY_SIZE(cfg->src_divs), 489 &flags)) 490 return false; 491 492 if (cfg->dst_divs[0].proportion_of_total) { 493 if (!valid_sg_divisions(cfg->dst_divs, 494 ARRAY_SIZE(cfg->dst_divs), &flags)) 495 return false; 496 } else { 497 if (memchr_inv(cfg->dst_divs, 0, sizeof(cfg->dst_divs))) 498 return false; 499 /* defaults to dst_divs=src_divs */ 500 } 501 502 if (cfg->iv_offset + 503 (cfg->iv_offset_relative_to_alignmask ? MAX_ALGAPI_ALIGNMASK : 0) > 504 MAX_ALGAPI_ALIGNMASK + 1) 505 return false; 506 507 if ((flags & (SGDIVS_HAVE_FLUSHES | SGDIVS_HAVE_NOSIMD)) && 508 cfg->finalization_type == FINALIZATION_TYPE_DIGEST) 509 return false; 510 511 if ((cfg->nosimd || (flags & SGDIVS_HAVE_NOSIMD)) && 512 (cfg->req_flags & CRYPTO_TFM_REQ_MAY_SLEEP)) 513 return false; 514 515 return true; 516 } 517 518 struct test_sglist { 519 char *bufs[XBUFSIZE]; 520 struct scatterlist sgl[XBUFSIZE]; 521 struct scatterlist sgl_saved[XBUFSIZE]; 522 struct scatterlist *sgl_ptr; 523 unsigned int nents; 524 }; 525 526 static int init_test_sglist(struct test_sglist *tsgl) 527 { 528 return __testmgr_alloc_buf(tsgl->bufs, 1 /* two pages per buffer */); 529 } 530 531 static void destroy_test_sglist(struct test_sglist *tsgl) 532 { 533 return __testmgr_free_buf(tsgl->bufs, 1 /* two pages per buffer */); 534 } 535 536 /** 537 * build_test_sglist() - build a scatterlist for a crypto test 538 * 539 * @tsgl: the scatterlist to build. @tsgl->bufs[] contains an array of 2-page 540 * buffers which the scatterlist @tsgl->sgl[] will be made to point into. 541 * @divs: the layout specification on which the scatterlist will be based 542 * @alignmask: the algorithm's alignmask 543 * @total_len: the total length of the scatterlist to build in bytes 544 * @data: if non-NULL, the buffers will be filled with this data until it ends. 545 * Otherwise the buffers will be poisoned. In both cases, some bytes 546 * past the end of each buffer will be poisoned to help detect overruns. 547 * @out_divs: if non-NULL, the test_sg_division to which each scatterlist entry 548 * corresponds will be returned here. This will match @divs except 549 * that divisions resolving to a length of 0 are omitted as they are 550 * not included in the scatterlist. 551 * 552 * Return: 0 or a -errno value 553 */ 554 static int build_test_sglist(struct test_sglist *tsgl, 555 const struct test_sg_division *divs, 556 const unsigned int alignmask, 557 const unsigned int total_len, 558 struct iov_iter *data, 559 const struct test_sg_division *out_divs[XBUFSIZE]) 560 { 561 struct { 562 const struct test_sg_division *div; 563 size_t length; 564 } partitions[XBUFSIZE]; 565 const unsigned int ndivs = count_test_sg_divisions(divs); 566 unsigned int len_remaining = total_len; 567 unsigned int i; 568 569 BUILD_BUG_ON(ARRAY_SIZE(partitions) != ARRAY_SIZE(tsgl->sgl)); 570 if (WARN_ON(ndivs > ARRAY_SIZE(partitions))) 571 return -EINVAL; 572 573 /* Calculate the (div, length) pairs */ 574 tsgl->nents = 0; 575 for (i = 0; i < ndivs; i++) { 576 unsigned int len_this_sg = 577 min(len_remaining, 578 (total_len * divs[i].proportion_of_total + 579 TEST_SG_TOTAL / 2) / TEST_SG_TOTAL); 580 581 if (len_this_sg != 0) { 582 partitions[tsgl->nents].div = &divs[i]; 583 partitions[tsgl->nents].length = len_this_sg; 584 tsgl->nents++; 585 len_remaining -= len_this_sg; 586 } 587 } 588 if (tsgl->nents == 0) { 589 partitions[tsgl->nents].div = &divs[0]; 590 partitions[tsgl->nents].length = 0; 591 tsgl->nents++; 592 } 593 partitions[tsgl->nents - 1].length += len_remaining; 594 595 /* Set up the sgl entries and fill the data or poison */ 596 sg_init_table(tsgl->sgl, tsgl->nents); 597 for (i = 0; i < tsgl->nents; i++) { 598 unsigned int offset = partitions[i].div->offset; 599 void *addr; 600 601 if (partitions[i].div->offset_relative_to_alignmask) 602 offset += alignmask; 603 604 while (offset + partitions[i].length + TESTMGR_POISON_LEN > 605 2 * PAGE_SIZE) { 606 if (WARN_ON(offset <= 0)) 607 return -EINVAL; 608 offset /= 2; 609 } 610 611 addr = &tsgl->bufs[i][offset]; 612 sg_set_buf(&tsgl->sgl[i], addr, partitions[i].length); 613 614 if (out_divs) 615 out_divs[i] = partitions[i].div; 616 617 if (data) { 618 size_t copy_len, copied; 619 620 copy_len = min(partitions[i].length, data->count); 621 copied = copy_from_iter(addr, copy_len, data); 622 if (WARN_ON(copied != copy_len)) 623 return -EINVAL; 624 testmgr_poison(addr + copy_len, partitions[i].length + 625 TESTMGR_POISON_LEN - copy_len); 626 } else { 627 testmgr_poison(addr, partitions[i].length + 628 TESTMGR_POISON_LEN); 629 } 630 } 631 632 sg_mark_end(&tsgl->sgl[tsgl->nents - 1]); 633 tsgl->sgl_ptr = tsgl->sgl; 634 memcpy(tsgl->sgl_saved, tsgl->sgl, tsgl->nents * sizeof(tsgl->sgl[0])); 635 return 0; 636 } 637 638 /* 639 * Verify that a scatterlist crypto operation produced the correct output. 640 * 641 * @tsgl: scatterlist containing the actual output 642 * @expected_output: buffer containing the expected output 643 * @len_to_check: length of @expected_output in bytes 644 * @unchecked_prefix_len: number of ignored bytes in @tsgl prior to real result 645 * @check_poison: verify that the poison bytes after each chunk are intact? 646 * 647 * Return: 0 if correct, -EINVAL if incorrect, -EOVERFLOW if buffer overrun. 648 */ 649 static int verify_correct_output(const struct test_sglist *tsgl, 650 const char *expected_output, 651 unsigned int len_to_check, 652 unsigned int unchecked_prefix_len, 653 bool check_poison) 654 { 655 unsigned int i; 656 657 for (i = 0; i < tsgl->nents; i++) { 658 struct scatterlist *sg = &tsgl->sgl_ptr[i]; 659 unsigned int len = sg->length; 660 unsigned int offset = sg->offset; 661 const char *actual_output; 662 663 if (unchecked_prefix_len) { 664 if (unchecked_prefix_len >= len) { 665 unchecked_prefix_len -= len; 666 continue; 667 } 668 offset += unchecked_prefix_len; 669 len -= unchecked_prefix_len; 670 unchecked_prefix_len = 0; 671 } 672 len = min(len, len_to_check); 673 actual_output = page_address(sg_page(sg)) + offset; 674 if (memcmp(expected_output, actual_output, len) != 0) 675 return -EINVAL; 676 if (check_poison && 677 !testmgr_is_poison(actual_output + len, TESTMGR_POISON_LEN)) 678 return -EOVERFLOW; 679 len_to_check -= len; 680 expected_output += len; 681 } 682 if (WARN_ON(len_to_check != 0)) 683 return -EINVAL; 684 return 0; 685 } 686 687 static bool is_test_sglist_corrupted(const struct test_sglist *tsgl) 688 { 689 unsigned int i; 690 691 for (i = 0; i < tsgl->nents; i++) { 692 if (tsgl->sgl[i].page_link != tsgl->sgl_saved[i].page_link) 693 return true; 694 if (tsgl->sgl[i].offset != tsgl->sgl_saved[i].offset) 695 return true; 696 if (tsgl->sgl[i].length != tsgl->sgl_saved[i].length) 697 return true; 698 } 699 return false; 700 } 701 702 struct cipher_test_sglists { 703 struct test_sglist src; 704 struct test_sglist dst; 705 }; 706 707 static struct cipher_test_sglists *alloc_cipher_test_sglists(void) 708 { 709 struct cipher_test_sglists *tsgls; 710 711 tsgls = kmalloc(sizeof(*tsgls), GFP_KERNEL); 712 if (!tsgls) 713 return NULL; 714 715 if (init_test_sglist(&tsgls->src) != 0) 716 goto fail_kfree; 717 if (init_test_sglist(&tsgls->dst) != 0) 718 goto fail_destroy_src; 719 720 return tsgls; 721 722 fail_destroy_src: 723 destroy_test_sglist(&tsgls->src); 724 fail_kfree: 725 kfree(tsgls); 726 return NULL; 727 } 728 729 static void free_cipher_test_sglists(struct cipher_test_sglists *tsgls) 730 { 731 if (tsgls) { 732 destroy_test_sglist(&tsgls->src); 733 destroy_test_sglist(&tsgls->dst); 734 kfree(tsgls); 735 } 736 } 737 738 /* Build the src and dst scatterlists for an skcipher or AEAD test */ 739 static int build_cipher_test_sglists(struct cipher_test_sglists *tsgls, 740 const struct testvec_config *cfg, 741 unsigned int alignmask, 742 unsigned int src_total_len, 743 unsigned int dst_total_len, 744 const struct kvec *inputs, 745 unsigned int nr_inputs) 746 { 747 struct iov_iter input; 748 int err; 749 750 iov_iter_kvec(&input, WRITE, inputs, nr_inputs, src_total_len); 751 err = build_test_sglist(&tsgls->src, cfg->src_divs, alignmask, 752 cfg->inplace ? 753 max(dst_total_len, src_total_len) : 754 src_total_len, 755 &input, NULL); 756 if (err) 757 return err; 758 759 if (cfg->inplace) { 760 tsgls->dst.sgl_ptr = tsgls->src.sgl; 761 tsgls->dst.nents = tsgls->src.nents; 762 return 0; 763 } 764 return build_test_sglist(&tsgls->dst, 765 cfg->dst_divs[0].proportion_of_total ? 766 cfg->dst_divs : cfg->src_divs, 767 alignmask, dst_total_len, NULL, NULL); 768 } 769 770 /* 771 * Support for testing passing a misaligned key to setkey(): 772 * 773 * If cfg->key_offset is set, copy the key into a new buffer at that offset, 774 * optionally adding alignmask. Else, just use the key directly. 775 */ 776 static int prepare_keybuf(const u8 *key, unsigned int ksize, 777 const struct testvec_config *cfg, 778 unsigned int alignmask, 779 const u8 **keybuf_ret, const u8 **keyptr_ret) 780 { 781 unsigned int key_offset = cfg->key_offset; 782 u8 *keybuf = NULL, *keyptr = (u8 *)key; 783 784 if (key_offset != 0) { 785 if (cfg->key_offset_relative_to_alignmask) 786 key_offset += alignmask; 787 keybuf = kmalloc(key_offset + ksize, GFP_KERNEL); 788 if (!keybuf) 789 return -ENOMEM; 790 keyptr = keybuf + key_offset; 791 memcpy(keyptr, key, ksize); 792 } 793 *keybuf_ret = keybuf; 794 *keyptr_ret = keyptr; 795 return 0; 796 } 797 798 /* Like setkey_f(tfm, key, ksize), but sometimes misalign the key */ 799 #define do_setkey(setkey_f, tfm, key, ksize, cfg, alignmask) \ 800 ({ \ 801 const u8 *keybuf, *keyptr; \ 802 int err; \ 803 \ 804 err = prepare_keybuf((key), (ksize), (cfg), (alignmask), \ 805 &keybuf, &keyptr); \ 806 if (err == 0) { \ 807 err = setkey_f((tfm), keyptr, (ksize)); \ 808 kfree(keybuf); \ 809 } \ 810 err; \ 811 }) 812 813 #ifdef CONFIG_CRYPTO_MANAGER_EXTRA_TESTS 814 815 /* Generate a random length in range [0, max_len], but prefer smaller values */ 816 static unsigned int generate_random_length(unsigned int max_len) 817 { 818 unsigned int len = prandom_u32() % (max_len + 1); 819 820 switch (prandom_u32() % 4) { 821 case 0: 822 return len % 64; 823 case 1: 824 return len % 256; 825 case 2: 826 return len % 1024; 827 default: 828 return len; 829 } 830 } 831 832 /* Flip a random bit in the given nonempty data buffer */ 833 static void flip_random_bit(u8 *buf, size_t size) 834 { 835 size_t bitpos; 836 837 bitpos = prandom_u32() % (size * 8); 838 buf[bitpos / 8] ^= 1 << (bitpos % 8); 839 } 840 841 /* Flip a random byte in the given nonempty data buffer */ 842 static void flip_random_byte(u8 *buf, size_t size) 843 { 844 buf[prandom_u32() % size] ^= 0xff; 845 } 846 847 /* Sometimes make some random changes to the given nonempty data buffer */ 848 static void mutate_buffer(u8 *buf, size_t size) 849 { 850 size_t num_flips; 851 size_t i; 852 853 /* Sometimes flip some bits */ 854 if (prandom_u32() % 4 == 0) { 855 num_flips = min_t(size_t, 1 << (prandom_u32() % 8), size * 8); 856 for (i = 0; i < num_flips; i++) 857 flip_random_bit(buf, size); 858 } 859 860 /* Sometimes flip some bytes */ 861 if (prandom_u32() % 4 == 0) { 862 num_flips = min_t(size_t, 1 << (prandom_u32() % 8), size); 863 for (i = 0; i < num_flips; i++) 864 flip_random_byte(buf, size); 865 } 866 } 867 868 /* Randomly generate 'count' bytes, but sometimes make them "interesting" */ 869 static void generate_random_bytes(u8 *buf, size_t count) 870 { 871 u8 b; 872 u8 increment; 873 size_t i; 874 875 if (count == 0) 876 return; 877 878 switch (prandom_u32() % 8) { /* Choose a generation strategy */ 879 case 0: 880 case 1: 881 /* All the same byte, plus optional mutations */ 882 switch (prandom_u32() % 4) { 883 case 0: 884 b = 0x00; 885 break; 886 case 1: 887 b = 0xff; 888 break; 889 default: 890 b = (u8)prandom_u32(); 891 break; 892 } 893 memset(buf, b, count); 894 mutate_buffer(buf, count); 895 break; 896 case 2: 897 /* Ascending or descending bytes, plus optional mutations */ 898 increment = (u8)prandom_u32(); 899 b = (u8)prandom_u32(); 900 for (i = 0; i < count; i++, b += increment) 901 buf[i] = b; 902 mutate_buffer(buf, count); 903 break; 904 default: 905 /* Fully random bytes */ 906 for (i = 0; i < count; i++) 907 buf[i] = (u8)prandom_u32(); 908 } 909 } 910 911 static char *generate_random_sgl_divisions(struct test_sg_division *divs, 912 size_t max_divs, char *p, char *end, 913 bool gen_flushes, u32 req_flags) 914 { 915 struct test_sg_division *div = divs; 916 unsigned int remaining = TEST_SG_TOTAL; 917 918 do { 919 unsigned int this_len; 920 const char *flushtype_str; 921 922 if (div == &divs[max_divs - 1] || prandom_u32() % 2 == 0) 923 this_len = remaining; 924 else 925 this_len = 1 + (prandom_u32() % remaining); 926 div->proportion_of_total = this_len; 927 928 if (prandom_u32() % 4 == 0) 929 div->offset = (PAGE_SIZE - 128) + (prandom_u32() % 128); 930 else if (prandom_u32() % 2 == 0) 931 div->offset = prandom_u32() % 32; 932 else 933 div->offset = prandom_u32() % PAGE_SIZE; 934 if (prandom_u32() % 8 == 0) 935 div->offset_relative_to_alignmask = true; 936 937 div->flush_type = FLUSH_TYPE_NONE; 938 if (gen_flushes) { 939 switch (prandom_u32() % 4) { 940 case 0: 941 div->flush_type = FLUSH_TYPE_REIMPORT; 942 break; 943 case 1: 944 div->flush_type = FLUSH_TYPE_FLUSH; 945 break; 946 } 947 } 948 949 if (div->flush_type != FLUSH_TYPE_NONE && 950 !(req_flags & CRYPTO_TFM_REQ_MAY_SLEEP) && 951 prandom_u32() % 2 == 0) 952 div->nosimd = true; 953 954 switch (div->flush_type) { 955 case FLUSH_TYPE_FLUSH: 956 if (div->nosimd) 957 flushtype_str = "<flush,nosimd>"; 958 else 959 flushtype_str = "<flush>"; 960 break; 961 case FLUSH_TYPE_REIMPORT: 962 if (div->nosimd) 963 flushtype_str = "<reimport,nosimd>"; 964 else 965 flushtype_str = "<reimport>"; 966 break; 967 default: 968 flushtype_str = ""; 969 break; 970 } 971 972 BUILD_BUG_ON(TEST_SG_TOTAL != 10000); /* for "%u.%u%%" */ 973 p += scnprintf(p, end - p, "%s%u.%u%%@%s+%u%s", flushtype_str, 974 this_len / 100, this_len % 100, 975 div->offset_relative_to_alignmask ? 976 "alignmask" : "", 977 div->offset, this_len == remaining ? "" : ", "); 978 remaining -= this_len; 979 div++; 980 } while (remaining); 981 982 return p; 983 } 984 985 /* Generate a random testvec_config for fuzz testing */ 986 static void generate_random_testvec_config(struct testvec_config *cfg, 987 char *name, size_t max_namelen) 988 { 989 char *p = name; 990 char * const end = name + max_namelen; 991 992 memset(cfg, 0, sizeof(*cfg)); 993 994 cfg->name = name; 995 996 p += scnprintf(p, end - p, "random:"); 997 998 if (prandom_u32() % 2 == 0) { 999 cfg->inplace = true; 1000 p += scnprintf(p, end - p, " inplace"); 1001 } 1002 1003 if (prandom_u32() % 2 == 0) { 1004 cfg->req_flags |= CRYPTO_TFM_REQ_MAY_SLEEP; 1005 p += scnprintf(p, end - p, " may_sleep"); 1006 } 1007 1008 switch (prandom_u32() % 4) { 1009 case 0: 1010 cfg->finalization_type = FINALIZATION_TYPE_FINAL; 1011 p += scnprintf(p, end - p, " use_final"); 1012 break; 1013 case 1: 1014 cfg->finalization_type = FINALIZATION_TYPE_FINUP; 1015 p += scnprintf(p, end - p, " use_finup"); 1016 break; 1017 default: 1018 cfg->finalization_type = FINALIZATION_TYPE_DIGEST; 1019 p += scnprintf(p, end - p, " use_digest"); 1020 break; 1021 } 1022 1023 if (!(cfg->req_flags & CRYPTO_TFM_REQ_MAY_SLEEP) && 1024 prandom_u32() % 2 == 0) { 1025 cfg->nosimd = true; 1026 p += scnprintf(p, end - p, " nosimd"); 1027 } 1028 1029 p += scnprintf(p, end - p, " src_divs=["); 1030 p = generate_random_sgl_divisions(cfg->src_divs, 1031 ARRAY_SIZE(cfg->src_divs), p, end, 1032 (cfg->finalization_type != 1033 FINALIZATION_TYPE_DIGEST), 1034 cfg->req_flags); 1035 p += scnprintf(p, end - p, "]"); 1036 1037 if (!cfg->inplace && prandom_u32() % 2 == 0) { 1038 p += scnprintf(p, end - p, " dst_divs=["); 1039 p = generate_random_sgl_divisions(cfg->dst_divs, 1040 ARRAY_SIZE(cfg->dst_divs), 1041 p, end, false, 1042 cfg->req_flags); 1043 p += scnprintf(p, end - p, "]"); 1044 } 1045 1046 if (prandom_u32() % 2 == 0) { 1047 cfg->iv_offset = 1 + (prandom_u32() % MAX_ALGAPI_ALIGNMASK); 1048 p += scnprintf(p, end - p, " iv_offset=%u", cfg->iv_offset); 1049 } 1050 1051 if (prandom_u32() % 2 == 0) { 1052 cfg->key_offset = 1 + (prandom_u32() % MAX_ALGAPI_ALIGNMASK); 1053 p += scnprintf(p, end - p, " key_offset=%u", cfg->key_offset); 1054 } 1055 1056 WARN_ON_ONCE(!valid_testvec_config(cfg)); 1057 } 1058 1059 static void crypto_disable_simd_for_test(void) 1060 { 1061 preempt_disable(); 1062 __this_cpu_write(crypto_simd_disabled_for_test, true); 1063 } 1064 1065 static void crypto_reenable_simd_for_test(void) 1066 { 1067 __this_cpu_write(crypto_simd_disabled_for_test, false); 1068 preempt_enable(); 1069 } 1070 1071 /* 1072 * Given an algorithm name, build the name of the generic implementation of that 1073 * algorithm, assuming the usual naming convention. Specifically, this appends 1074 * "-generic" to every part of the name that is not a template name. Examples: 1075 * 1076 * aes => aes-generic 1077 * cbc(aes) => cbc(aes-generic) 1078 * cts(cbc(aes)) => cts(cbc(aes-generic)) 1079 * rfc7539(chacha20,poly1305) => rfc7539(chacha20-generic,poly1305-generic) 1080 * 1081 * Return: 0 on success, or -ENAMETOOLONG if the generic name would be too long 1082 */ 1083 static int build_generic_driver_name(const char *algname, 1084 char driver_name[CRYPTO_MAX_ALG_NAME]) 1085 { 1086 const char *in = algname; 1087 char *out = driver_name; 1088 size_t len = strlen(algname); 1089 1090 if (len >= CRYPTO_MAX_ALG_NAME) 1091 goto too_long; 1092 do { 1093 const char *in_saved = in; 1094 1095 while (*in && *in != '(' && *in != ')' && *in != ',') 1096 *out++ = *in++; 1097 if (*in != '(' && in > in_saved) { 1098 len += 8; 1099 if (len >= CRYPTO_MAX_ALG_NAME) 1100 goto too_long; 1101 memcpy(out, "-generic", 8); 1102 out += 8; 1103 } 1104 } while ((*out++ = *in++) != '\0'); 1105 return 0; 1106 1107 too_long: 1108 pr_err("alg: generic driver name for \"%s\" would be too long\n", 1109 algname); 1110 return -ENAMETOOLONG; 1111 } 1112 #else /* !CONFIG_CRYPTO_MANAGER_EXTRA_TESTS */ 1113 static void crypto_disable_simd_for_test(void) 1114 { 1115 } 1116 1117 static void crypto_reenable_simd_for_test(void) 1118 { 1119 } 1120 #endif /* !CONFIG_CRYPTO_MANAGER_EXTRA_TESTS */ 1121 1122 static int build_hash_sglist(struct test_sglist *tsgl, 1123 const struct hash_testvec *vec, 1124 const struct testvec_config *cfg, 1125 unsigned int alignmask, 1126 const struct test_sg_division *divs[XBUFSIZE]) 1127 { 1128 struct kvec kv; 1129 struct iov_iter input; 1130 1131 kv.iov_base = (void *)vec->plaintext; 1132 kv.iov_len = vec->psize; 1133 iov_iter_kvec(&input, WRITE, &kv, 1, vec->psize); 1134 return build_test_sglist(tsgl, cfg->src_divs, alignmask, vec->psize, 1135 &input, divs); 1136 } 1137 1138 static int check_hash_result(const char *type, 1139 const u8 *result, unsigned int digestsize, 1140 const struct hash_testvec *vec, 1141 const char *vec_name, 1142 const char *driver, 1143 const struct testvec_config *cfg) 1144 { 1145 if (memcmp(result, vec->digest, digestsize) != 0) { 1146 pr_err("alg: %s: %s test failed (wrong result) on test vector %s, cfg=\"%s\"\n", 1147 type, driver, vec_name, cfg->name); 1148 return -EINVAL; 1149 } 1150 if (!testmgr_is_poison(&result[digestsize], TESTMGR_POISON_LEN)) { 1151 pr_err("alg: %s: %s overran result buffer on test vector %s, cfg=\"%s\"\n", 1152 type, driver, vec_name, cfg->name); 1153 return -EOVERFLOW; 1154 } 1155 return 0; 1156 } 1157 1158 static inline int check_shash_op(const char *op, int err, 1159 const char *driver, const char *vec_name, 1160 const struct testvec_config *cfg) 1161 { 1162 if (err) 1163 pr_err("alg: shash: %s %s() failed with err %d on test vector %s, cfg=\"%s\"\n", 1164 driver, op, err, vec_name, cfg->name); 1165 return err; 1166 } 1167 1168 static inline const void *sg_data(struct scatterlist *sg) 1169 { 1170 return page_address(sg_page(sg)) + sg->offset; 1171 } 1172 1173 /* Test one hash test vector in one configuration, using the shash API */ 1174 static int test_shash_vec_cfg(const struct hash_testvec *vec, 1175 const char *vec_name, 1176 const struct testvec_config *cfg, 1177 struct shash_desc *desc, 1178 struct test_sglist *tsgl, 1179 u8 *hashstate) 1180 { 1181 struct crypto_shash *tfm = desc->tfm; 1182 const unsigned int alignmask = crypto_shash_alignmask(tfm); 1183 const unsigned int digestsize = crypto_shash_digestsize(tfm); 1184 const unsigned int statesize = crypto_shash_statesize(tfm); 1185 const char *driver = crypto_shash_driver_name(tfm); 1186 const struct test_sg_division *divs[XBUFSIZE]; 1187 unsigned int i; 1188 u8 result[HASH_MAX_DIGESTSIZE + TESTMGR_POISON_LEN]; 1189 int err; 1190 1191 /* Set the key, if specified */ 1192 if (vec->ksize) { 1193 err = do_setkey(crypto_shash_setkey, tfm, vec->key, vec->ksize, 1194 cfg, alignmask); 1195 if (err) { 1196 if (err == vec->setkey_error) 1197 return 0; 1198 pr_err("alg: shash: %s setkey failed on test vector %s; expected_error=%d, actual_error=%d, flags=%#x\n", 1199 driver, vec_name, vec->setkey_error, err, 1200 crypto_shash_get_flags(tfm)); 1201 return err; 1202 } 1203 if (vec->setkey_error) { 1204 pr_err("alg: shash: %s setkey unexpectedly succeeded on test vector %s; expected_error=%d\n", 1205 driver, vec_name, vec->setkey_error); 1206 return -EINVAL; 1207 } 1208 } 1209 1210 /* Build the scatterlist for the source data */ 1211 err = build_hash_sglist(tsgl, vec, cfg, alignmask, divs); 1212 if (err) { 1213 pr_err("alg: shash: %s: error preparing scatterlist for test vector %s, cfg=\"%s\"\n", 1214 driver, vec_name, cfg->name); 1215 return err; 1216 } 1217 1218 /* Do the actual hashing */ 1219 1220 testmgr_poison(desc->__ctx, crypto_shash_descsize(tfm)); 1221 testmgr_poison(result, digestsize + TESTMGR_POISON_LEN); 1222 1223 if (cfg->finalization_type == FINALIZATION_TYPE_DIGEST || 1224 vec->digest_error) { 1225 /* Just using digest() */ 1226 if (tsgl->nents != 1) 1227 return 0; 1228 if (cfg->nosimd) 1229 crypto_disable_simd_for_test(); 1230 err = crypto_shash_digest(desc, sg_data(&tsgl->sgl[0]), 1231 tsgl->sgl[0].length, result); 1232 if (cfg->nosimd) 1233 crypto_reenable_simd_for_test(); 1234 if (err) { 1235 if (err == vec->digest_error) 1236 return 0; 1237 pr_err("alg: shash: %s digest() failed on test vector %s; expected_error=%d, actual_error=%d, cfg=\"%s\"\n", 1238 driver, vec_name, vec->digest_error, err, 1239 cfg->name); 1240 return err; 1241 } 1242 if (vec->digest_error) { 1243 pr_err("alg: shash: %s digest() unexpectedly succeeded on test vector %s; expected_error=%d, cfg=\"%s\"\n", 1244 driver, vec_name, vec->digest_error, cfg->name); 1245 return -EINVAL; 1246 } 1247 goto result_ready; 1248 } 1249 1250 /* Using init(), zero or more update(), then final() or finup() */ 1251 1252 if (cfg->nosimd) 1253 crypto_disable_simd_for_test(); 1254 err = crypto_shash_init(desc); 1255 if (cfg->nosimd) 1256 crypto_reenable_simd_for_test(); 1257 err = check_shash_op("init", err, driver, vec_name, cfg); 1258 if (err) 1259 return err; 1260 1261 for (i = 0; i < tsgl->nents; i++) { 1262 if (i + 1 == tsgl->nents && 1263 cfg->finalization_type == FINALIZATION_TYPE_FINUP) { 1264 if (divs[i]->nosimd) 1265 crypto_disable_simd_for_test(); 1266 err = crypto_shash_finup(desc, sg_data(&tsgl->sgl[i]), 1267 tsgl->sgl[i].length, result); 1268 if (divs[i]->nosimd) 1269 crypto_reenable_simd_for_test(); 1270 err = check_shash_op("finup", err, driver, vec_name, 1271 cfg); 1272 if (err) 1273 return err; 1274 goto result_ready; 1275 } 1276 if (divs[i]->nosimd) 1277 crypto_disable_simd_for_test(); 1278 err = crypto_shash_update(desc, sg_data(&tsgl->sgl[i]), 1279 tsgl->sgl[i].length); 1280 if (divs[i]->nosimd) 1281 crypto_reenable_simd_for_test(); 1282 err = check_shash_op("update", err, driver, vec_name, cfg); 1283 if (err) 1284 return err; 1285 if (divs[i]->flush_type == FLUSH_TYPE_REIMPORT) { 1286 /* Test ->export() and ->import() */ 1287 testmgr_poison(hashstate + statesize, 1288 TESTMGR_POISON_LEN); 1289 err = crypto_shash_export(desc, hashstate); 1290 err = check_shash_op("export", err, driver, vec_name, 1291 cfg); 1292 if (err) 1293 return err; 1294 if (!testmgr_is_poison(hashstate + statesize, 1295 TESTMGR_POISON_LEN)) { 1296 pr_err("alg: shash: %s export() overran state buffer on test vector %s, cfg=\"%s\"\n", 1297 driver, vec_name, cfg->name); 1298 return -EOVERFLOW; 1299 } 1300 testmgr_poison(desc->__ctx, crypto_shash_descsize(tfm)); 1301 err = crypto_shash_import(desc, hashstate); 1302 err = check_shash_op("import", err, driver, vec_name, 1303 cfg); 1304 if (err) 1305 return err; 1306 } 1307 } 1308 1309 if (cfg->nosimd) 1310 crypto_disable_simd_for_test(); 1311 err = crypto_shash_final(desc, result); 1312 if (cfg->nosimd) 1313 crypto_reenable_simd_for_test(); 1314 err = check_shash_op("final", err, driver, vec_name, cfg); 1315 if (err) 1316 return err; 1317 result_ready: 1318 return check_hash_result("shash", result, digestsize, vec, vec_name, 1319 driver, cfg); 1320 } 1321 1322 static int do_ahash_op(int (*op)(struct ahash_request *req), 1323 struct ahash_request *req, 1324 struct crypto_wait *wait, bool nosimd) 1325 { 1326 int err; 1327 1328 if (nosimd) 1329 crypto_disable_simd_for_test(); 1330 1331 err = op(req); 1332 1333 if (nosimd) 1334 crypto_reenable_simd_for_test(); 1335 1336 return crypto_wait_req(err, wait); 1337 } 1338 1339 static int check_nonfinal_ahash_op(const char *op, int err, 1340 u8 *result, unsigned int digestsize, 1341 const char *driver, const char *vec_name, 1342 const struct testvec_config *cfg) 1343 { 1344 if (err) { 1345 pr_err("alg: ahash: %s %s() failed with err %d on test vector %s, cfg=\"%s\"\n", 1346 driver, op, err, vec_name, cfg->name); 1347 return err; 1348 } 1349 if (!testmgr_is_poison(result, digestsize)) { 1350 pr_err("alg: ahash: %s %s() used result buffer on test vector %s, cfg=\"%s\"\n", 1351 driver, op, vec_name, cfg->name); 1352 return -EINVAL; 1353 } 1354 return 0; 1355 } 1356 1357 /* Test one hash test vector in one configuration, using the ahash API */ 1358 static int test_ahash_vec_cfg(const struct hash_testvec *vec, 1359 const char *vec_name, 1360 const struct testvec_config *cfg, 1361 struct ahash_request *req, 1362 struct test_sglist *tsgl, 1363 u8 *hashstate) 1364 { 1365 struct crypto_ahash *tfm = crypto_ahash_reqtfm(req); 1366 const unsigned int alignmask = crypto_ahash_alignmask(tfm); 1367 const unsigned int digestsize = crypto_ahash_digestsize(tfm); 1368 const unsigned int statesize = crypto_ahash_statesize(tfm); 1369 const char *driver = crypto_ahash_driver_name(tfm); 1370 const u32 req_flags = CRYPTO_TFM_REQ_MAY_BACKLOG | cfg->req_flags; 1371 const struct test_sg_division *divs[XBUFSIZE]; 1372 DECLARE_CRYPTO_WAIT(wait); 1373 unsigned int i; 1374 struct scatterlist *pending_sgl; 1375 unsigned int pending_len; 1376 u8 result[HASH_MAX_DIGESTSIZE + TESTMGR_POISON_LEN]; 1377 int err; 1378 1379 /* Set the key, if specified */ 1380 if (vec->ksize) { 1381 err = do_setkey(crypto_ahash_setkey, tfm, vec->key, vec->ksize, 1382 cfg, alignmask); 1383 if (err) { 1384 if (err == vec->setkey_error) 1385 return 0; 1386 pr_err("alg: ahash: %s setkey failed on test vector %s; expected_error=%d, actual_error=%d, flags=%#x\n", 1387 driver, vec_name, vec->setkey_error, err, 1388 crypto_ahash_get_flags(tfm)); 1389 return err; 1390 } 1391 if (vec->setkey_error) { 1392 pr_err("alg: ahash: %s setkey unexpectedly succeeded on test vector %s; expected_error=%d\n", 1393 driver, vec_name, vec->setkey_error); 1394 return -EINVAL; 1395 } 1396 } 1397 1398 /* Build the scatterlist for the source data */ 1399 err = build_hash_sglist(tsgl, vec, cfg, alignmask, divs); 1400 if (err) { 1401 pr_err("alg: ahash: %s: error preparing scatterlist for test vector %s, cfg=\"%s\"\n", 1402 driver, vec_name, cfg->name); 1403 return err; 1404 } 1405 1406 /* Do the actual hashing */ 1407 1408 testmgr_poison(req->__ctx, crypto_ahash_reqsize(tfm)); 1409 testmgr_poison(result, digestsize + TESTMGR_POISON_LEN); 1410 1411 if (cfg->finalization_type == FINALIZATION_TYPE_DIGEST || 1412 vec->digest_error) { 1413 /* Just using digest() */ 1414 ahash_request_set_callback(req, req_flags, crypto_req_done, 1415 &wait); 1416 ahash_request_set_crypt(req, tsgl->sgl, result, vec->psize); 1417 err = do_ahash_op(crypto_ahash_digest, req, &wait, cfg->nosimd); 1418 if (err) { 1419 if (err == vec->digest_error) 1420 return 0; 1421 pr_err("alg: ahash: %s digest() failed on test vector %s; expected_error=%d, actual_error=%d, cfg=\"%s\"\n", 1422 driver, vec_name, vec->digest_error, err, 1423 cfg->name); 1424 return err; 1425 } 1426 if (vec->digest_error) { 1427 pr_err("alg: ahash: %s digest() unexpectedly succeeded on test vector %s; expected_error=%d, cfg=\"%s\"\n", 1428 driver, vec_name, vec->digest_error, cfg->name); 1429 return -EINVAL; 1430 } 1431 goto result_ready; 1432 } 1433 1434 /* Using init(), zero or more update(), then final() or finup() */ 1435 1436 ahash_request_set_callback(req, req_flags, crypto_req_done, &wait); 1437 ahash_request_set_crypt(req, NULL, result, 0); 1438 err = do_ahash_op(crypto_ahash_init, req, &wait, cfg->nosimd); 1439 err = check_nonfinal_ahash_op("init", err, result, digestsize, 1440 driver, vec_name, cfg); 1441 if (err) 1442 return err; 1443 1444 pending_sgl = NULL; 1445 pending_len = 0; 1446 for (i = 0; i < tsgl->nents; i++) { 1447 if (divs[i]->flush_type != FLUSH_TYPE_NONE && 1448 pending_sgl != NULL) { 1449 /* update() with the pending data */ 1450 ahash_request_set_callback(req, req_flags, 1451 crypto_req_done, &wait); 1452 ahash_request_set_crypt(req, pending_sgl, result, 1453 pending_len); 1454 err = do_ahash_op(crypto_ahash_update, req, &wait, 1455 divs[i]->nosimd); 1456 err = check_nonfinal_ahash_op("update", err, 1457 result, digestsize, 1458 driver, vec_name, cfg); 1459 if (err) 1460 return err; 1461 pending_sgl = NULL; 1462 pending_len = 0; 1463 } 1464 if (divs[i]->flush_type == FLUSH_TYPE_REIMPORT) { 1465 /* Test ->export() and ->import() */ 1466 testmgr_poison(hashstate + statesize, 1467 TESTMGR_POISON_LEN); 1468 err = crypto_ahash_export(req, hashstate); 1469 err = check_nonfinal_ahash_op("export", err, 1470 result, digestsize, 1471 driver, vec_name, cfg); 1472 if (err) 1473 return err; 1474 if (!testmgr_is_poison(hashstate + statesize, 1475 TESTMGR_POISON_LEN)) { 1476 pr_err("alg: ahash: %s export() overran state buffer on test vector %s, cfg=\"%s\"\n", 1477 driver, vec_name, cfg->name); 1478 return -EOVERFLOW; 1479 } 1480 1481 testmgr_poison(req->__ctx, crypto_ahash_reqsize(tfm)); 1482 err = crypto_ahash_import(req, hashstate); 1483 err = check_nonfinal_ahash_op("import", err, 1484 result, digestsize, 1485 driver, vec_name, cfg); 1486 if (err) 1487 return err; 1488 } 1489 if (pending_sgl == NULL) 1490 pending_sgl = &tsgl->sgl[i]; 1491 pending_len += tsgl->sgl[i].length; 1492 } 1493 1494 ahash_request_set_callback(req, req_flags, crypto_req_done, &wait); 1495 ahash_request_set_crypt(req, pending_sgl, result, pending_len); 1496 if (cfg->finalization_type == FINALIZATION_TYPE_FINAL) { 1497 /* finish with update() and final() */ 1498 err = do_ahash_op(crypto_ahash_update, req, &wait, cfg->nosimd); 1499 err = check_nonfinal_ahash_op("update", err, result, digestsize, 1500 driver, vec_name, cfg); 1501 if (err) 1502 return err; 1503 err = do_ahash_op(crypto_ahash_final, req, &wait, cfg->nosimd); 1504 if (err) { 1505 pr_err("alg: ahash: %s final() failed with err %d on test vector %s, cfg=\"%s\"\n", 1506 driver, err, vec_name, cfg->name); 1507 return err; 1508 } 1509 } else { 1510 /* finish with finup() */ 1511 err = do_ahash_op(crypto_ahash_finup, req, &wait, cfg->nosimd); 1512 if (err) { 1513 pr_err("alg: ahash: %s finup() failed with err %d on test vector %s, cfg=\"%s\"\n", 1514 driver, err, vec_name, cfg->name); 1515 return err; 1516 } 1517 } 1518 1519 result_ready: 1520 return check_hash_result("ahash", result, digestsize, vec, vec_name, 1521 driver, cfg); 1522 } 1523 1524 static int test_hash_vec_cfg(const struct hash_testvec *vec, 1525 const char *vec_name, 1526 const struct testvec_config *cfg, 1527 struct ahash_request *req, 1528 struct shash_desc *desc, 1529 struct test_sglist *tsgl, 1530 u8 *hashstate) 1531 { 1532 int err; 1533 1534 /* 1535 * For algorithms implemented as "shash", most bugs will be detected by 1536 * both the shash and ahash tests. Test the shash API first so that the 1537 * failures involve less indirection, so are easier to debug. 1538 */ 1539 1540 if (desc) { 1541 err = test_shash_vec_cfg(vec, vec_name, cfg, desc, tsgl, 1542 hashstate); 1543 if (err) 1544 return err; 1545 } 1546 1547 return test_ahash_vec_cfg(vec, vec_name, cfg, req, tsgl, hashstate); 1548 } 1549 1550 static int test_hash_vec(const struct hash_testvec *vec, unsigned int vec_num, 1551 struct ahash_request *req, struct shash_desc *desc, 1552 struct test_sglist *tsgl, u8 *hashstate) 1553 { 1554 char vec_name[16]; 1555 unsigned int i; 1556 int err; 1557 1558 sprintf(vec_name, "%u", vec_num); 1559 1560 for (i = 0; i < ARRAY_SIZE(default_hash_testvec_configs); i++) { 1561 err = test_hash_vec_cfg(vec, vec_name, 1562 &default_hash_testvec_configs[i], 1563 req, desc, tsgl, hashstate); 1564 if (err) 1565 return err; 1566 } 1567 1568 #ifdef CONFIG_CRYPTO_MANAGER_EXTRA_TESTS 1569 if (!noextratests) { 1570 struct testvec_config cfg; 1571 char cfgname[TESTVEC_CONFIG_NAMELEN]; 1572 1573 for (i = 0; i < fuzz_iterations; i++) { 1574 generate_random_testvec_config(&cfg, cfgname, 1575 sizeof(cfgname)); 1576 err = test_hash_vec_cfg(vec, vec_name, &cfg, 1577 req, desc, tsgl, hashstate); 1578 if (err) 1579 return err; 1580 cond_resched(); 1581 } 1582 } 1583 #endif 1584 return 0; 1585 } 1586 1587 #ifdef CONFIG_CRYPTO_MANAGER_EXTRA_TESTS 1588 /* 1589 * Generate a hash test vector from the given implementation. 1590 * Assumes the buffers in 'vec' were already allocated. 1591 */ 1592 static void generate_random_hash_testvec(struct shash_desc *desc, 1593 struct hash_testvec *vec, 1594 unsigned int maxkeysize, 1595 unsigned int maxdatasize, 1596 char *name, size_t max_namelen) 1597 { 1598 /* Data */ 1599 vec->psize = generate_random_length(maxdatasize); 1600 generate_random_bytes((u8 *)vec->plaintext, vec->psize); 1601 1602 /* 1603 * Key: length in range [1, maxkeysize], but usually choose maxkeysize. 1604 * If algorithm is unkeyed, then maxkeysize == 0 and set ksize = 0. 1605 */ 1606 vec->setkey_error = 0; 1607 vec->ksize = 0; 1608 if (maxkeysize) { 1609 vec->ksize = maxkeysize; 1610 if (prandom_u32() % 4 == 0) 1611 vec->ksize = 1 + (prandom_u32() % maxkeysize); 1612 generate_random_bytes((u8 *)vec->key, vec->ksize); 1613 1614 vec->setkey_error = crypto_shash_setkey(desc->tfm, vec->key, 1615 vec->ksize); 1616 /* If the key couldn't be set, no need to continue to digest. */ 1617 if (vec->setkey_error) 1618 goto done; 1619 } 1620 1621 /* Digest */ 1622 vec->digest_error = crypto_shash_digest(desc, vec->plaintext, 1623 vec->psize, (u8 *)vec->digest); 1624 done: 1625 snprintf(name, max_namelen, "\"random: psize=%u ksize=%u\"", 1626 vec->psize, vec->ksize); 1627 } 1628 1629 /* 1630 * Test the hash algorithm represented by @req against the corresponding generic 1631 * implementation, if one is available. 1632 */ 1633 static int test_hash_vs_generic_impl(const char *generic_driver, 1634 unsigned int maxkeysize, 1635 struct ahash_request *req, 1636 struct shash_desc *desc, 1637 struct test_sglist *tsgl, 1638 u8 *hashstate) 1639 { 1640 struct crypto_ahash *tfm = crypto_ahash_reqtfm(req); 1641 const unsigned int digestsize = crypto_ahash_digestsize(tfm); 1642 const unsigned int blocksize = crypto_ahash_blocksize(tfm); 1643 const unsigned int maxdatasize = (2 * PAGE_SIZE) - TESTMGR_POISON_LEN; 1644 const char *algname = crypto_hash_alg_common(tfm)->base.cra_name; 1645 const char *driver = crypto_ahash_driver_name(tfm); 1646 char _generic_driver[CRYPTO_MAX_ALG_NAME]; 1647 struct crypto_shash *generic_tfm = NULL; 1648 struct shash_desc *generic_desc = NULL; 1649 unsigned int i; 1650 struct hash_testvec vec = { 0 }; 1651 char vec_name[64]; 1652 struct testvec_config *cfg; 1653 char cfgname[TESTVEC_CONFIG_NAMELEN]; 1654 int err; 1655 1656 if (noextratests) 1657 return 0; 1658 1659 if (!generic_driver) { /* Use default naming convention? */ 1660 err = build_generic_driver_name(algname, _generic_driver); 1661 if (err) 1662 return err; 1663 generic_driver = _generic_driver; 1664 } 1665 1666 if (strcmp(generic_driver, driver) == 0) /* Already the generic impl? */ 1667 return 0; 1668 1669 generic_tfm = crypto_alloc_shash(generic_driver, 0, 0); 1670 if (IS_ERR(generic_tfm)) { 1671 err = PTR_ERR(generic_tfm); 1672 if (err == -ENOENT) { 1673 pr_warn("alg: hash: skipping comparison tests for %s because %s is unavailable\n", 1674 driver, generic_driver); 1675 return 0; 1676 } 1677 pr_err("alg: hash: error allocating %s (generic impl of %s): %d\n", 1678 generic_driver, algname, err); 1679 return err; 1680 } 1681 1682 cfg = kzalloc(sizeof(*cfg), GFP_KERNEL); 1683 if (!cfg) { 1684 err = -ENOMEM; 1685 goto out; 1686 } 1687 1688 generic_desc = kzalloc(sizeof(*desc) + 1689 crypto_shash_descsize(generic_tfm), GFP_KERNEL); 1690 if (!generic_desc) { 1691 err = -ENOMEM; 1692 goto out; 1693 } 1694 generic_desc->tfm = generic_tfm; 1695 1696 /* Check the algorithm properties for consistency. */ 1697 1698 if (digestsize != crypto_shash_digestsize(generic_tfm)) { 1699 pr_err("alg: hash: digestsize for %s (%u) doesn't match generic impl (%u)\n", 1700 driver, digestsize, 1701 crypto_shash_digestsize(generic_tfm)); 1702 err = -EINVAL; 1703 goto out; 1704 } 1705 1706 if (blocksize != crypto_shash_blocksize(generic_tfm)) { 1707 pr_err("alg: hash: blocksize for %s (%u) doesn't match generic impl (%u)\n", 1708 driver, blocksize, crypto_shash_blocksize(generic_tfm)); 1709 err = -EINVAL; 1710 goto out; 1711 } 1712 1713 /* 1714 * Now generate test vectors using the generic implementation, and test 1715 * the other implementation against them. 1716 */ 1717 1718 vec.key = kmalloc(maxkeysize, GFP_KERNEL); 1719 vec.plaintext = kmalloc(maxdatasize, GFP_KERNEL); 1720 vec.digest = kmalloc(digestsize, GFP_KERNEL); 1721 if (!vec.key || !vec.plaintext || !vec.digest) { 1722 err = -ENOMEM; 1723 goto out; 1724 } 1725 1726 for (i = 0; i < fuzz_iterations * 8; i++) { 1727 generate_random_hash_testvec(generic_desc, &vec, 1728 maxkeysize, maxdatasize, 1729 vec_name, sizeof(vec_name)); 1730 generate_random_testvec_config(cfg, cfgname, sizeof(cfgname)); 1731 1732 err = test_hash_vec_cfg(&vec, vec_name, cfg, 1733 req, desc, tsgl, hashstate); 1734 if (err) 1735 goto out; 1736 cond_resched(); 1737 } 1738 err = 0; 1739 out: 1740 kfree(cfg); 1741 kfree(vec.key); 1742 kfree(vec.plaintext); 1743 kfree(vec.digest); 1744 crypto_free_shash(generic_tfm); 1745 kfree_sensitive(generic_desc); 1746 return err; 1747 } 1748 #else /* !CONFIG_CRYPTO_MANAGER_EXTRA_TESTS */ 1749 static int test_hash_vs_generic_impl(const char *generic_driver, 1750 unsigned int maxkeysize, 1751 struct ahash_request *req, 1752 struct shash_desc *desc, 1753 struct test_sglist *tsgl, 1754 u8 *hashstate) 1755 { 1756 return 0; 1757 } 1758 #endif /* !CONFIG_CRYPTO_MANAGER_EXTRA_TESTS */ 1759 1760 static int alloc_shash(const char *driver, u32 type, u32 mask, 1761 struct crypto_shash **tfm_ret, 1762 struct shash_desc **desc_ret) 1763 { 1764 struct crypto_shash *tfm; 1765 struct shash_desc *desc; 1766 1767 tfm = crypto_alloc_shash(driver, type, mask); 1768 if (IS_ERR(tfm)) { 1769 if (PTR_ERR(tfm) == -ENOENT) { 1770 /* 1771 * This algorithm is only available through the ahash 1772 * API, not the shash API, so skip the shash tests. 1773 */ 1774 return 0; 1775 } 1776 pr_err("alg: hash: failed to allocate shash transform for %s: %ld\n", 1777 driver, PTR_ERR(tfm)); 1778 return PTR_ERR(tfm); 1779 } 1780 1781 desc = kmalloc(sizeof(*desc) + crypto_shash_descsize(tfm), GFP_KERNEL); 1782 if (!desc) { 1783 crypto_free_shash(tfm); 1784 return -ENOMEM; 1785 } 1786 desc->tfm = tfm; 1787 1788 *tfm_ret = tfm; 1789 *desc_ret = desc; 1790 return 0; 1791 } 1792 1793 static int __alg_test_hash(const struct hash_testvec *vecs, 1794 unsigned int num_vecs, const char *driver, 1795 u32 type, u32 mask, 1796 const char *generic_driver, unsigned int maxkeysize) 1797 { 1798 struct crypto_ahash *atfm = NULL; 1799 struct ahash_request *req = NULL; 1800 struct crypto_shash *stfm = NULL; 1801 struct shash_desc *desc = NULL; 1802 struct test_sglist *tsgl = NULL; 1803 u8 *hashstate = NULL; 1804 unsigned int statesize; 1805 unsigned int i; 1806 int err; 1807 1808 /* 1809 * Always test the ahash API. This works regardless of whether the 1810 * algorithm is implemented as ahash or shash. 1811 */ 1812 1813 atfm = crypto_alloc_ahash(driver, type, mask); 1814 if (IS_ERR(atfm)) { 1815 pr_err("alg: hash: failed to allocate transform for %s: %ld\n", 1816 driver, PTR_ERR(atfm)); 1817 return PTR_ERR(atfm); 1818 } 1819 driver = crypto_ahash_driver_name(atfm); 1820 1821 req = ahash_request_alloc(atfm, GFP_KERNEL); 1822 if (!req) { 1823 pr_err("alg: hash: failed to allocate request for %s\n", 1824 driver); 1825 err = -ENOMEM; 1826 goto out; 1827 } 1828 1829 /* 1830 * If available also test the shash API, to cover corner cases that may 1831 * be missed by testing the ahash API only. 1832 */ 1833 err = alloc_shash(driver, type, mask, &stfm, &desc); 1834 if (err) 1835 goto out; 1836 1837 tsgl = kmalloc(sizeof(*tsgl), GFP_KERNEL); 1838 if (!tsgl || init_test_sglist(tsgl) != 0) { 1839 pr_err("alg: hash: failed to allocate test buffers for %s\n", 1840 driver); 1841 kfree(tsgl); 1842 tsgl = NULL; 1843 err = -ENOMEM; 1844 goto out; 1845 } 1846 1847 statesize = crypto_ahash_statesize(atfm); 1848 if (stfm) 1849 statesize = max(statesize, crypto_shash_statesize(stfm)); 1850 hashstate = kmalloc(statesize + TESTMGR_POISON_LEN, GFP_KERNEL); 1851 if (!hashstate) { 1852 pr_err("alg: hash: failed to allocate hash state buffer for %s\n", 1853 driver); 1854 err = -ENOMEM; 1855 goto out; 1856 } 1857 1858 for (i = 0; i < num_vecs; i++) { 1859 err = test_hash_vec(&vecs[i], i, req, desc, tsgl, hashstate); 1860 if (err) 1861 goto out; 1862 cond_resched(); 1863 } 1864 err = test_hash_vs_generic_impl(generic_driver, maxkeysize, req, 1865 desc, tsgl, hashstate); 1866 out: 1867 kfree(hashstate); 1868 if (tsgl) { 1869 destroy_test_sglist(tsgl); 1870 kfree(tsgl); 1871 } 1872 kfree(desc); 1873 crypto_free_shash(stfm); 1874 ahash_request_free(req); 1875 crypto_free_ahash(atfm); 1876 return err; 1877 } 1878 1879 static int alg_test_hash(const struct alg_test_desc *desc, const char *driver, 1880 u32 type, u32 mask) 1881 { 1882 const struct hash_testvec *template = desc->suite.hash.vecs; 1883 unsigned int tcount = desc->suite.hash.count; 1884 unsigned int nr_unkeyed, nr_keyed; 1885 unsigned int maxkeysize = 0; 1886 int err; 1887 1888 /* 1889 * For OPTIONAL_KEY algorithms, we have to do all the unkeyed tests 1890 * first, before setting a key on the tfm. To make this easier, we 1891 * require that the unkeyed test vectors (if any) are listed first. 1892 */ 1893 1894 for (nr_unkeyed = 0; nr_unkeyed < tcount; nr_unkeyed++) { 1895 if (template[nr_unkeyed].ksize) 1896 break; 1897 } 1898 for (nr_keyed = 0; nr_unkeyed + nr_keyed < tcount; nr_keyed++) { 1899 if (!template[nr_unkeyed + nr_keyed].ksize) { 1900 pr_err("alg: hash: test vectors for %s out of order, " 1901 "unkeyed ones must come first\n", desc->alg); 1902 return -EINVAL; 1903 } 1904 maxkeysize = max_t(unsigned int, maxkeysize, 1905 template[nr_unkeyed + nr_keyed].ksize); 1906 } 1907 1908 err = 0; 1909 if (nr_unkeyed) { 1910 err = __alg_test_hash(template, nr_unkeyed, driver, type, mask, 1911 desc->generic_driver, maxkeysize); 1912 template += nr_unkeyed; 1913 } 1914 1915 if (!err && nr_keyed) 1916 err = __alg_test_hash(template, nr_keyed, driver, type, mask, 1917 desc->generic_driver, maxkeysize); 1918 1919 return err; 1920 } 1921 1922 static int test_aead_vec_cfg(const char *driver, int enc, 1923 const struct aead_testvec *vec, 1924 const char *vec_name, 1925 const struct testvec_config *cfg, 1926 struct aead_request *req, 1927 struct cipher_test_sglists *tsgls) 1928 { 1929 struct crypto_aead *tfm = crypto_aead_reqtfm(req); 1930 const unsigned int alignmask = crypto_aead_alignmask(tfm); 1931 const unsigned int ivsize = crypto_aead_ivsize(tfm); 1932 const unsigned int authsize = vec->clen - vec->plen; 1933 const u32 req_flags = CRYPTO_TFM_REQ_MAY_BACKLOG | cfg->req_flags; 1934 const char *op = enc ? "encryption" : "decryption"; 1935 DECLARE_CRYPTO_WAIT(wait); 1936 u8 _iv[3 * (MAX_ALGAPI_ALIGNMASK + 1) + MAX_IVLEN]; 1937 u8 *iv = PTR_ALIGN(&_iv[0], 2 * (MAX_ALGAPI_ALIGNMASK + 1)) + 1938 cfg->iv_offset + 1939 (cfg->iv_offset_relative_to_alignmask ? alignmask : 0); 1940 struct kvec input[2]; 1941 int err; 1942 1943 /* Set the key */ 1944 if (vec->wk) 1945 crypto_aead_set_flags(tfm, CRYPTO_TFM_REQ_FORBID_WEAK_KEYS); 1946 else 1947 crypto_aead_clear_flags(tfm, CRYPTO_TFM_REQ_FORBID_WEAK_KEYS); 1948 1949 err = do_setkey(crypto_aead_setkey, tfm, vec->key, vec->klen, 1950 cfg, alignmask); 1951 if (err && err != vec->setkey_error) { 1952 pr_err("alg: aead: %s setkey failed on test vector %s; expected_error=%d, actual_error=%d, flags=%#x\n", 1953 driver, vec_name, vec->setkey_error, err, 1954 crypto_aead_get_flags(tfm)); 1955 return err; 1956 } 1957 if (!err && vec->setkey_error) { 1958 pr_err("alg: aead: %s setkey unexpectedly succeeded on test vector %s; expected_error=%d\n", 1959 driver, vec_name, vec->setkey_error); 1960 return -EINVAL; 1961 } 1962 1963 /* Set the authentication tag size */ 1964 err = crypto_aead_setauthsize(tfm, authsize); 1965 if (err && err != vec->setauthsize_error) { 1966 pr_err("alg: aead: %s setauthsize failed on test vector %s; expected_error=%d, actual_error=%d\n", 1967 driver, vec_name, vec->setauthsize_error, err); 1968 return err; 1969 } 1970 if (!err && vec->setauthsize_error) { 1971 pr_err("alg: aead: %s setauthsize unexpectedly succeeded on test vector %s; expected_error=%d\n", 1972 driver, vec_name, vec->setauthsize_error); 1973 return -EINVAL; 1974 } 1975 1976 if (vec->setkey_error || vec->setauthsize_error) 1977 return 0; 1978 1979 /* The IV must be copied to a buffer, as the algorithm may modify it */ 1980 if (WARN_ON(ivsize > MAX_IVLEN)) 1981 return -EINVAL; 1982 if (vec->iv) 1983 memcpy(iv, vec->iv, ivsize); 1984 else 1985 memset(iv, 0, ivsize); 1986 1987 /* Build the src/dst scatterlists */ 1988 input[0].iov_base = (void *)vec->assoc; 1989 input[0].iov_len = vec->alen; 1990 input[1].iov_base = enc ? (void *)vec->ptext : (void *)vec->ctext; 1991 input[1].iov_len = enc ? vec->plen : vec->clen; 1992 err = build_cipher_test_sglists(tsgls, cfg, alignmask, 1993 vec->alen + (enc ? vec->plen : 1994 vec->clen), 1995 vec->alen + (enc ? vec->clen : 1996 vec->plen), 1997 input, 2); 1998 if (err) { 1999 pr_err("alg: aead: %s %s: error preparing scatterlists for test vector %s, cfg=\"%s\"\n", 2000 driver, op, vec_name, cfg->name); 2001 return err; 2002 } 2003 2004 /* Do the actual encryption or decryption */ 2005 testmgr_poison(req->__ctx, crypto_aead_reqsize(tfm)); 2006 aead_request_set_callback(req, req_flags, crypto_req_done, &wait); 2007 aead_request_set_crypt(req, tsgls->src.sgl_ptr, tsgls->dst.sgl_ptr, 2008 enc ? vec->plen : vec->clen, iv); 2009 aead_request_set_ad(req, vec->alen); 2010 if (cfg->nosimd) 2011 crypto_disable_simd_for_test(); 2012 err = enc ? crypto_aead_encrypt(req) : crypto_aead_decrypt(req); 2013 if (cfg->nosimd) 2014 crypto_reenable_simd_for_test(); 2015 err = crypto_wait_req(err, &wait); 2016 2017 /* Check that the algorithm didn't overwrite things it shouldn't have */ 2018 if (req->cryptlen != (enc ? vec->plen : vec->clen) || 2019 req->assoclen != vec->alen || 2020 req->iv != iv || 2021 req->src != tsgls->src.sgl_ptr || 2022 req->dst != tsgls->dst.sgl_ptr || 2023 crypto_aead_reqtfm(req) != tfm || 2024 req->base.complete != crypto_req_done || 2025 req->base.flags != req_flags || 2026 req->base.data != &wait) { 2027 pr_err("alg: aead: %s %s corrupted request struct on test vector %s, cfg=\"%s\"\n", 2028 driver, op, vec_name, cfg->name); 2029 if (req->cryptlen != (enc ? vec->plen : vec->clen)) 2030 pr_err("alg: aead: changed 'req->cryptlen'\n"); 2031 if (req->assoclen != vec->alen) 2032 pr_err("alg: aead: changed 'req->assoclen'\n"); 2033 if (req->iv != iv) 2034 pr_err("alg: aead: changed 'req->iv'\n"); 2035 if (req->src != tsgls->src.sgl_ptr) 2036 pr_err("alg: aead: changed 'req->src'\n"); 2037 if (req->dst != tsgls->dst.sgl_ptr) 2038 pr_err("alg: aead: changed 'req->dst'\n"); 2039 if (crypto_aead_reqtfm(req) != tfm) 2040 pr_err("alg: aead: changed 'req->base.tfm'\n"); 2041 if (req->base.complete != crypto_req_done) 2042 pr_err("alg: aead: changed 'req->base.complete'\n"); 2043 if (req->base.flags != req_flags) 2044 pr_err("alg: aead: changed 'req->base.flags'\n"); 2045 if (req->base.data != &wait) 2046 pr_err("alg: aead: changed 'req->base.data'\n"); 2047 return -EINVAL; 2048 } 2049 if (is_test_sglist_corrupted(&tsgls->src)) { 2050 pr_err("alg: aead: %s %s corrupted src sgl on test vector %s, cfg=\"%s\"\n", 2051 driver, op, vec_name, cfg->name); 2052 return -EINVAL; 2053 } 2054 if (tsgls->dst.sgl_ptr != tsgls->src.sgl && 2055 is_test_sglist_corrupted(&tsgls->dst)) { 2056 pr_err("alg: aead: %s %s corrupted dst sgl on test vector %s, cfg=\"%s\"\n", 2057 driver, op, vec_name, cfg->name); 2058 return -EINVAL; 2059 } 2060 2061 /* Check for unexpected success or failure, or wrong error code */ 2062 if ((err == 0 && vec->novrfy) || 2063 (err != vec->crypt_error && !(err == -EBADMSG && vec->novrfy))) { 2064 char expected_error[32]; 2065 2066 if (vec->novrfy && 2067 vec->crypt_error != 0 && vec->crypt_error != -EBADMSG) 2068 sprintf(expected_error, "-EBADMSG or %d", 2069 vec->crypt_error); 2070 else if (vec->novrfy) 2071 sprintf(expected_error, "-EBADMSG"); 2072 else 2073 sprintf(expected_error, "%d", vec->crypt_error); 2074 if (err) { 2075 pr_err("alg: aead: %s %s failed on test vector %s; expected_error=%s, actual_error=%d, cfg=\"%s\"\n", 2076 driver, op, vec_name, expected_error, err, 2077 cfg->name); 2078 return err; 2079 } 2080 pr_err("alg: aead: %s %s unexpectedly succeeded on test vector %s; expected_error=%s, cfg=\"%s\"\n", 2081 driver, op, vec_name, expected_error, cfg->name); 2082 return -EINVAL; 2083 } 2084 if (err) /* Expectedly failed. */ 2085 return 0; 2086 2087 /* Check for the correct output (ciphertext or plaintext) */ 2088 err = verify_correct_output(&tsgls->dst, enc ? vec->ctext : vec->ptext, 2089 enc ? vec->clen : vec->plen, 2090 vec->alen, enc || !cfg->inplace); 2091 if (err == -EOVERFLOW) { 2092 pr_err("alg: aead: %s %s overran dst buffer on test vector %s, cfg=\"%s\"\n", 2093 driver, op, vec_name, cfg->name); 2094 return err; 2095 } 2096 if (err) { 2097 pr_err("alg: aead: %s %s test failed (wrong result) on test vector %s, cfg=\"%s\"\n", 2098 driver, op, vec_name, cfg->name); 2099 return err; 2100 } 2101 2102 return 0; 2103 } 2104 2105 static int test_aead_vec(const char *driver, int enc, 2106 const struct aead_testvec *vec, unsigned int vec_num, 2107 struct aead_request *req, 2108 struct cipher_test_sglists *tsgls) 2109 { 2110 char vec_name[16]; 2111 unsigned int i; 2112 int err; 2113 2114 if (enc && vec->novrfy) 2115 return 0; 2116 2117 sprintf(vec_name, "%u", vec_num); 2118 2119 for (i = 0; i < ARRAY_SIZE(default_cipher_testvec_configs); i++) { 2120 err = test_aead_vec_cfg(driver, enc, vec, vec_name, 2121 &default_cipher_testvec_configs[i], 2122 req, tsgls); 2123 if (err) 2124 return err; 2125 } 2126 2127 #ifdef CONFIG_CRYPTO_MANAGER_EXTRA_TESTS 2128 if (!noextratests) { 2129 struct testvec_config cfg; 2130 char cfgname[TESTVEC_CONFIG_NAMELEN]; 2131 2132 for (i = 0; i < fuzz_iterations; i++) { 2133 generate_random_testvec_config(&cfg, cfgname, 2134 sizeof(cfgname)); 2135 err = test_aead_vec_cfg(driver, enc, vec, vec_name, 2136 &cfg, req, tsgls); 2137 if (err) 2138 return err; 2139 cond_resched(); 2140 } 2141 } 2142 #endif 2143 return 0; 2144 } 2145 2146 #ifdef CONFIG_CRYPTO_MANAGER_EXTRA_TESTS 2147 2148 struct aead_extra_tests_ctx { 2149 struct aead_request *req; 2150 struct crypto_aead *tfm; 2151 const char *driver; 2152 const struct alg_test_desc *test_desc; 2153 struct cipher_test_sglists *tsgls; 2154 unsigned int maxdatasize; 2155 unsigned int maxkeysize; 2156 2157 struct aead_testvec vec; 2158 char vec_name[64]; 2159 char cfgname[TESTVEC_CONFIG_NAMELEN]; 2160 struct testvec_config cfg; 2161 }; 2162 2163 /* 2164 * Make at least one random change to a (ciphertext, AAD) pair. "Ciphertext" 2165 * here means the full ciphertext including the authentication tag. The 2166 * authentication tag (and hence also the ciphertext) is assumed to be nonempty. 2167 */ 2168 static void mutate_aead_message(struct aead_testvec *vec, bool aad_iv, 2169 unsigned int ivsize) 2170 { 2171 const unsigned int aad_tail_size = aad_iv ? ivsize : 0; 2172 const unsigned int authsize = vec->clen - vec->plen; 2173 2174 if (prandom_u32() % 2 == 0 && vec->alen > aad_tail_size) { 2175 /* Mutate the AAD */ 2176 flip_random_bit((u8 *)vec->assoc, vec->alen - aad_tail_size); 2177 if (prandom_u32() % 2 == 0) 2178 return; 2179 } 2180 if (prandom_u32() % 2 == 0) { 2181 /* Mutate auth tag (assuming it's at the end of ciphertext) */ 2182 flip_random_bit((u8 *)vec->ctext + vec->plen, authsize); 2183 } else { 2184 /* Mutate any part of the ciphertext */ 2185 flip_random_bit((u8 *)vec->ctext, vec->clen); 2186 } 2187 } 2188 2189 /* 2190 * Minimum authentication tag size in bytes at which we assume that we can 2191 * reliably generate inauthentic messages, i.e. not generate an authentic 2192 * message by chance. 2193 */ 2194 #define MIN_COLLISION_FREE_AUTHSIZE 8 2195 2196 static void generate_aead_message(struct aead_request *req, 2197 const struct aead_test_suite *suite, 2198 struct aead_testvec *vec, 2199 bool prefer_inauthentic) 2200 { 2201 struct crypto_aead *tfm = crypto_aead_reqtfm(req); 2202 const unsigned int ivsize = crypto_aead_ivsize(tfm); 2203 const unsigned int authsize = vec->clen - vec->plen; 2204 const bool inauthentic = (authsize >= MIN_COLLISION_FREE_AUTHSIZE) && 2205 (prefer_inauthentic || prandom_u32() % 4 == 0); 2206 2207 /* Generate the AAD. */ 2208 generate_random_bytes((u8 *)vec->assoc, vec->alen); 2209 if (suite->aad_iv && vec->alen >= ivsize) 2210 /* Avoid implementation-defined behavior. */ 2211 memcpy((u8 *)vec->assoc + vec->alen - ivsize, vec->iv, ivsize); 2212 2213 if (inauthentic && prandom_u32() % 2 == 0) { 2214 /* Generate a random ciphertext. */ 2215 generate_random_bytes((u8 *)vec->ctext, vec->clen); 2216 } else { 2217 int i = 0; 2218 struct scatterlist src[2], dst; 2219 u8 iv[MAX_IVLEN]; 2220 DECLARE_CRYPTO_WAIT(wait); 2221 2222 /* Generate a random plaintext and encrypt it. */ 2223 sg_init_table(src, 2); 2224 if (vec->alen) 2225 sg_set_buf(&src[i++], vec->assoc, vec->alen); 2226 if (vec->plen) { 2227 generate_random_bytes((u8 *)vec->ptext, vec->plen); 2228 sg_set_buf(&src[i++], vec->ptext, vec->plen); 2229 } 2230 sg_init_one(&dst, vec->ctext, vec->alen + vec->clen); 2231 memcpy(iv, vec->iv, ivsize); 2232 aead_request_set_callback(req, 0, crypto_req_done, &wait); 2233 aead_request_set_crypt(req, src, &dst, vec->plen, iv); 2234 aead_request_set_ad(req, vec->alen); 2235 vec->crypt_error = crypto_wait_req(crypto_aead_encrypt(req), 2236 &wait); 2237 /* If encryption failed, we're done. */ 2238 if (vec->crypt_error != 0) 2239 return; 2240 memmove((u8 *)vec->ctext, vec->ctext + vec->alen, vec->clen); 2241 if (!inauthentic) 2242 return; 2243 /* 2244 * Mutate the authentic (ciphertext, AAD) pair to get an 2245 * inauthentic one. 2246 */ 2247 mutate_aead_message(vec, suite->aad_iv, ivsize); 2248 } 2249 vec->novrfy = 1; 2250 if (suite->einval_allowed) 2251 vec->crypt_error = -EINVAL; 2252 } 2253 2254 /* 2255 * Generate an AEAD test vector 'vec' using the implementation specified by 2256 * 'req'. The buffers in 'vec' must already be allocated. 2257 * 2258 * If 'prefer_inauthentic' is true, then this function will generate inauthentic 2259 * test vectors (i.e. vectors with 'vec->novrfy=1') more often. 2260 */ 2261 static void generate_random_aead_testvec(struct aead_request *req, 2262 struct aead_testvec *vec, 2263 const struct aead_test_suite *suite, 2264 unsigned int maxkeysize, 2265 unsigned int maxdatasize, 2266 char *name, size_t max_namelen, 2267 bool prefer_inauthentic) 2268 { 2269 struct crypto_aead *tfm = crypto_aead_reqtfm(req); 2270 const unsigned int ivsize = crypto_aead_ivsize(tfm); 2271 const unsigned int maxauthsize = crypto_aead_maxauthsize(tfm); 2272 unsigned int authsize; 2273 unsigned int total_len; 2274 2275 /* Key: length in [0, maxkeysize], but usually choose maxkeysize */ 2276 vec->klen = maxkeysize; 2277 if (prandom_u32() % 4 == 0) 2278 vec->klen = prandom_u32() % (maxkeysize + 1); 2279 generate_random_bytes((u8 *)vec->key, vec->klen); 2280 vec->setkey_error = crypto_aead_setkey(tfm, vec->key, vec->klen); 2281 2282 /* IV */ 2283 generate_random_bytes((u8 *)vec->iv, ivsize); 2284 2285 /* Tag length: in [0, maxauthsize], but usually choose maxauthsize */ 2286 authsize = maxauthsize; 2287 if (prandom_u32() % 4 == 0) 2288 authsize = prandom_u32() % (maxauthsize + 1); 2289 if (prefer_inauthentic && authsize < MIN_COLLISION_FREE_AUTHSIZE) 2290 authsize = MIN_COLLISION_FREE_AUTHSIZE; 2291 if (WARN_ON(authsize > maxdatasize)) 2292 authsize = maxdatasize; 2293 maxdatasize -= authsize; 2294 vec->setauthsize_error = crypto_aead_setauthsize(tfm, authsize); 2295 2296 /* AAD, plaintext, and ciphertext lengths */ 2297 total_len = generate_random_length(maxdatasize); 2298 if (prandom_u32() % 4 == 0) 2299 vec->alen = 0; 2300 else 2301 vec->alen = generate_random_length(total_len); 2302 vec->plen = total_len - vec->alen; 2303 vec->clen = vec->plen + authsize; 2304 2305 /* 2306 * Generate the AAD, plaintext, and ciphertext. Not applicable if the 2307 * key or the authentication tag size couldn't be set. 2308 */ 2309 vec->novrfy = 0; 2310 vec->crypt_error = 0; 2311 if (vec->setkey_error == 0 && vec->setauthsize_error == 0) 2312 generate_aead_message(req, suite, vec, prefer_inauthentic); 2313 snprintf(name, max_namelen, 2314 "\"random: alen=%u plen=%u authsize=%u klen=%u novrfy=%d\"", 2315 vec->alen, vec->plen, authsize, vec->klen, vec->novrfy); 2316 } 2317 2318 static void try_to_generate_inauthentic_testvec( 2319 struct aead_extra_tests_ctx *ctx) 2320 { 2321 int i; 2322 2323 for (i = 0; i < 10; i++) { 2324 generate_random_aead_testvec(ctx->req, &ctx->vec, 2325 &ctx->test_desc->suite.aead, 2326 ctx->maxkeysize, ctx->maxdatasize, 2327 ctx->vec_name, 2328 sizeof(ctx->vec_name), true); 2329 if (ctx->vec.novrfy) 2330 return; 2331 } 2332 } 2333 2334 /* 2335 * Generate inauthentic test vectors (i.e. ciphertext, AAD pairs that aren't the 2336 * result of an encryption with the key) and verify that decryption fails. 2337 */ 2338 static int test_aead_inauthentic_inputs(struct aead_extra_tests_ctx *ctx) 2339 { 2340 unsigned int i; 2341 int err; 2342 2343 for (i = 0; i < fuzz_iterations * 8; i++) { 2344 /* 2345 * Since this part of the tests isn't comparing the 2346 * implementation to another, there's no point in testing any 2347 * test vectors other than inauthentic ones (vec.novrfy=1) here. 2348 * 2349 * If we're having trouble generating such a test vector, e.g. 2350 * if the algorithm keeps rejecting the generated keys, don't 2351 * retry forever; just continue on. 2352 */ 2353 try_to_generate_inauthentic_testvec(ctx); 2354 if (ctx->vec.novrfy) { 2355 generate_random_testvec_config(&ctx->cfg, ctx->cfgname, 2356 sizeof(ctx->cfgname)); 2357 err = test_aead_vec_cfg(ctx->driver, DECRYPT, &ctx->vec, 2358 ctx->vec_name, &ctx->cfg, 2359 ctx->req, ctx->tsgls); 2360 if (err) 2361 return err; 2362 } 2363 cond_resched(); 2364 } 2365 return 0; 2366 } 2367 2368 /* 2369 * Test the AEAD algorithm against the corresponding generic implementation, if 2370 * one is available. 2371 */ 2372 static int test_aead_vs_generic_impl(struct aead_extra_tests_ctx *ctx) 2373 { 2374 struct crypto_aead *tfm = ctx->tfm; 2375 const char *algname = crypto_aead_alg(tfm)->base.cra_name; 2376 const char *driver = ctx->driver; 2377 const char *generic_driver = ctx->test_desc->generic_driver; 2378 char _generic_driver[CRYPTO_MAX_ALG_NAME]; 2379 struct crypto_aead *generic_tfm = NULL; 2380 struct aead_request *generic_req = NULL; 2381 unsigned int i; 2382 int err; 2383 2384 if (!generic_driver) { /* Use default naming convention? */ 2385 err = build_generic_driver_name(algname, _generic_driver); 2386 if (err) 2387 return err; 2388 generic_driver = _generic_driver; 2389 } 2390 2391 if (strcmp(generic_driver, driver) == 0) /* Already the generic impl? */ 2392 return 0; 2393 2394 generic_tfm = crypto_alloc_aead(generic_driver, 0, 0); 2395 if (IS_ERR(generic_tfm)) { 2396 err = PTR_ERR(generic_tfm); 2397 if (err == -ENOENT) { 2398 pr_warn("alg: aead: skipping comparison tests for %s because %s is unavailable\n", 2399 driver, generic_driver); 2400 return 0; 2401 } 2402 pr_err("alg: aead: error allocating %s (generic impl of %s): %d\n", 2403 generic_driver, algname, err); 2404 return err; 2405 } 2406 2407 generic_req = aead_request_alloc(generic_tfm, GFP_KERNEL); 2408 if (!generic_req) { 2409 err = -ENOMEM; 2410 goto out; 2411 } 2412 2413 /* Check the algorithm properties for consistency. */ 2414 2415 if (crypto_aead_maxauthsize(tfm) != 2416 crypto_aead_maxauthsize(generic_tfm)) { 2417 pr_err("alg: aead: maxauthsize for %s (%u) doesn't match generic impl (%u)\n", 2418 driver, crypto_aead_maxauthsize(tfm), 2419 crypto_aead_maxauthsize(generic_tfm)); 2420 err = -EINVAL; 2421 goto out; 2422 } 2423 2424 if (crypto_aead_ivsize(tfm) != crypto_aead_ivsize(generic_tfm)) { 2425 pr_err("alg: aead: ivsize for %s (%u) doesn't match generic impl (%u)\n", 2426 driver, crypto_aead_ivsize(tfm), 2427 crypto_aead_ivsize(generic_tfm)); 2428 err = -EINVAL; 2429 goto out; 2430 } 2431 2432 if (crypto_aead_blocksize(tfm) != crypto_aead_blocksize(generic_tfm)) { 2433 pr_err("alg: aead: blocksize for %s (%u) doesn't match generic impl (%u)\n", 2434 driver, crypto_aead_blocksize(tfm), 2435 crypto_aead_blocksize(generic_tfm)); 2436 err = -EINVAL; 2437 goto out; 2438 } 2439 2440 /* 2441 * Now generate test vectors using the generic implementation, and test 2442 * the other implementation against them. 2443 */ 2444 for (i = 0; i < fuzz_iterations * 8; i++) { 2445 generate_random_aead_testvec(generic_req, &ctx->vec, 2446 &ctx->test_desc->suite.aead, 2447 ctx->maxkeysize, ctx->maxdatasize, 2448 ctx->vec_name, 2449 sizeof(ctx->vec_name), false); 2450 generate_random_testvec_config(&ctx->cfg, ctx->cfgname, 2451 sizeof(ctx->cfgname)); 2452 if (!ctx->vec.novrfy) { 2453 err = test_aead_vec_cfg(driver, ENCRYPT, &ctx->vec, 2454 ctx->vec_name, &ctx->cfg, 2455 ctx->req, ctx->tsgls); 2456 if (err) 2457 goto out; 2458 } 2459 if (ctx->vec.crypt_error == 0 || ctx->vec.novrfy) { 2460 err = test_aead_vec_cfg(driver, DECRYPT, &ctx->vec, 2461 ctx->vec_name, &ctx->cfg, 2462 ctx->req, ctx->tsgls); 2463 if (err) 2464 goto out; 2465 } 2466 cond_resched(); 2467 } 2468 err = 0; 2469 out: 2470 crypto_free_aead(generic_tfm); 2471 aead_request_free(generic_req); 2472 return err; 2473 } 2474 2475 static int test_aead_extra(const char *driver, 2476 const struct alg_test_desc *test_desc, 2477 struct aead_request *req, 2478 struct cipher_test_sglists *tsgls) 2479 { 2480 struct aead_extra_tests_ctx *ctx; 2481 unsigned int i; 2482 int err; 2483 2484 if (noextratests) 2485 return 0; 2486 2487 ctx = kzalloc(sizeof(*ctx), GFP_KERNEL); 2488 if (!ctx) 2489 return -ENOMEM; 2490 ctx->req = req; 2491 ctx->tfm = crypto_aead_reqtfm(req); 2492 ctx->driver = driver; 2493 ctx->test_desc = test_desc; 2494 ctx->tsgls = tsgls; 2495 ctx->maxdatasize = (2 * PAGE_SIZE) - TESTMGR_POISON_LEN; 2496 ctx->maxkeysize = 0; 2497 for (i = 0; i < test_desc->suite.aead.count; i++) 2498 ctx->maxkeysize = max_t(unsigned int, ctx->maxkeysize, 2499 test_desc->suite.aead.vecs[i].klen); 2500 2501 ctx->vec.key = kmalloc(ctx->maxkeysize, GFP_KERNEL); 2502 ctx->vec.iv = kmalloc(crypto_aead_ivsize(ctx->tfm), GFP_KERNEL); 2503 ctx->vec.assoc = kmalloc(ctx->maxdatasize, GFP_KERNEL); 2504 ctx->vec.ptext = kmalloc(ctx->maxdatasize, GFP_KERNEL); 2505 ctx->vec.ctext = kmalloc(ctx->maxdatasize, GFP_KERNEL); 2506 if (!ctx->vec.key || !ctx->vec.iv || !ctx->vec.assoc || 2507 !ctx->vec.ptext || !ctx->vec.ctext) { 2508 err = -ENOMEM; 2509 goto out; 2510 } 2511 2512 err = test_aead_vs_generic_impl(ctx); 2513 if (err) 2514 goto out; 2515 2516 err = test_aead_inauthentic_inputs(ctx); 2517 out: 2518 kfree(ctx->vec.key); 2519 kfree(ctx->vec.iv); 2520 kfree(ctx->vec.assoc); 2521 kfree(ctx->vec.ptext); 2522 kfree(ctx->vec.ctext); 2523 kfree(ctx); 2524 return err; 2525 } 2526 #else /* !CONFIG_CRYPTO_MANAGER_EXTRA_TESTS */ 2527 static int test_aead_extra(const char *driver, 2528 const struct alg_test_desc *test_desc, 2529 struct aead_request *req, 2530 struct cipher_test_sglists *tsgls) 2531 { 2532 return 0; 2533 } 2534 #endif /* !CONFIG_CRYPTO_MANAGER_EXTRA_TESTS */ 2535 2536 static int test_aead(const char *driver, int enc, 2537 const struct aead_test_suite *suite, 2538 struct aead_request *req, 2539 struct cipher_test_sglists *tsgls) 2540 { 2541 unsigned int i; 2542 int err; 2543 2544 for (i = 0; i < suite->count; i++) { 2545 err = test_aead_vec(driver, enc, &suite->vecs[i], i, req, 2546 tsgls); 2547 if (err) 2548 return err; 2549 cond_resched(); 2550 } 2551 return 0; 2552 } 2553 2554 static int alg_test_aead(const struct alg_test_desc *desc, const char *driver, 2555 u32 type, u32 mask) 2556 { 2557 const struct aead_test_suite *suite = &desc->suite.aead; 2558 struct crypto_aead *tfm; 2559 struct aead_request *req = NULL; 2560 struct cipher_test_sglists *tsgls = NULL; 2561 int err; 2562 2563 if (suite->count <= 0) { 2564 pr_err("alg: aead: empty test suite for %s\n", driver); 2565 return -EINVAL; 2566 } 2567 2568 tfm = crypto_alloc_aead(driver, type, mask); 2569 if (IS_ERR(tfm)) { 2570 pr_err("alg: aead: failed to allocate transform for %s: %ld\n", 2571 driver, PTR_ERR(tfm)); 2572 return PTR_ERR(tfm); 2573 } 2574 2575 req = aead_request_alloc(tfm, GFP_KERNEL); 2576 if (!req) { 2577 pr_err("alg: aead: failed to allocate request for %s\n", 2578 driver); 2579 err = -ENOMEM; 2580 goto out; 2581 } 2582 2583 tsgls = alloc_cipher_test_sglists(); 2584 if (!tsgls) { 2585 pr_err("alg: aead: failed to allocate test buffers for %s\n", 2586 driver); 2587 err = -ENOMEM; 2588 goto out; 2589 } 2590 2591 err = test_aead(driver, ENCRYPT, suite, req, tsgls); 2592 if (err) 2593 goto out; 2594 2595 err = test_aead(driver, DECRYPT, suite, req, tsgls); 2596 if (err) 2597 goto out; 2598 2599 err = test_aead_extra(driver, desc, req, tsgls); 2600 out: 2601 free_cipher_test_sglists(tsgls); 2602 aead_request_free(req); 2603 crypto_free_aead(tfm); 2604 return err; 2605 } 2606 2607 static int test_cipher(struct crypto_cipher *tfm, int enc, 2608 const struct cipher_testvec *template, 2609 unsigned int tcount) 2610 { 2611 const char *algo = crypto_tfm_alg_driver_name(crypto_cipher_tfm(tfm)); 2612 unsigned int i, j, k; 2613 char *q; 2614 const char *e; 2615 const char *input, *result; 2616 void *data; 2617 char *xbuf[XBUFSIZE]; 2618 int ret = -ENOMEM; 2619 2620 if (testmgr_alloc_buf(xbuf)) 2621 goto out_nobuf; 2622 2623 if (enc == ENCRYPT) 2624 e = "encryption"; 2625 else 2626 e = "decryption"; 2627 2628 j = 0; 2629 for (i = 0; i < tcount; i++) { 2630 2631 if (fips_enabled && template[i].fips_skip) 2632 continue; 2633 2634 input = enc ? template[i].ptext : template[i].ctext; 2635 result = enc ? template[i].ctext : template[i].ptext; 2636 j++; 2637 2638 ret = -EINVAL; 2639 if (WARN_ON(template[i].len > PAGE_SIZE)) 2640 goto out; 2641 2642 data = xbuf[0]; 2643 memcpy(data, input, template[i].len); 2644 2645 crypto_cipher_clear_flags(tfm, ~0); 2646 if (template[i].wk) 2647 crypto_cipher_set_flags(tfm, CRYPTO_TFM_REQ_FORBID_WEAK_KEYS); 2648 2649 ret = crypto_cipher_setkey(tfm, template[i].key, 2650 template[i].klen); 2651 if (ret) { 2652 if (ret == template[i].setkey_error) 2653 continue; 2654 pr_err("alg: cipher: %s setkey failed on test vector %u; expected_error=%d, actual_error=%d, flags=%#x\n", 2655 algo, j, template[i].setkey_error, ret, 2656 crypto_cipher_get_flags(tfm)); 2657 goto out; 2658 } 2659 if (template[i].setkey_error) { 2660 pr_err("alg: cipher: %s setkey unexpectedly succeeded on test vector %u; expected_error=%d\n", 2661 algo, j, template[i].setkey_error); 2662 ret = -EINVAL; 2663 goto out; 2664 } 2665 2666 for (k = 0; k < template[i].len; 2667 k += crypto_cipher_blocksize(tfm)) { 2668 if (enc) 2669 crypto_cipher_encrypt_one(tfm, data + k, 2670 data + k); 2671 else 2672 crypto_cipher_decrypt_one(tfm, data + k, 2673 data + k); 2674 } 2675 2676 q = data; 2677 if (memcmp(q, result, template[i].len)) { 2678 printk(KERN_ERR "alg: cipher: Test %d failed " 2679 "on %s for %s\n", j, e, algo); 2680 hexdump(q, template[i].len); 2681 ret = -EINVAL; 2682 goto out; 2683 } 2684 } 2685 2686 ret = 0; 2687 2688 out: 2689 testmgr_free_buf(xbuf); 2690 out_nobuf: 2691 return ret; 2692 } 2693 2694 static int test_skcipher_vec_cfg(const char *driver, int enc, 2695 const struct cipher_testvec *vec, 2696 const char *vec_name, 2697 const struct testvec_config *cfg, 2698 struct skcipher_request *req, 2699 struct cipher_test_sglists *tsgls) 2700 { 2701 struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req); 2702 const unsigned int alignmask = crypto_skcipher_alignmask(tfm); 2703 const unsigned int ivsize = crypto_skcipher_ivsize(tfm); 2704 const u32 req_flags = CRYPTO_TFM_REQ_MAY_BACKLOG | cfg->req_flags; 2705 const char *op = enc ? "encryption" : "decryption"; 2706 DECLARE_CRYPTO_WAIT(wait); 2707 u8 _iv[3 * (MAX_ALGAPI_ALIGNMASK + 1) + MAX_IVLEN]; 2708 u8 *iv = PTR_ALIGN(&_iv[0], 2 * (MAX_ALGAPI_ALIGNMASK + 1)) + 2709 cfg->iv_offset + 2710 (cfg->iv_offset_relative_to_alignmask ? alignmask : 0); 2711 struct kvec input; 2712 int err; 2713 2714 /* Set the key */ 2715 if (vec->wk) 2716 crypto_skcipher_set_flags(tfm, CRYPTO_TFM_REQ_FORBID_WEAK_KEYS); 2717 else 2718 crypto_skcipher_clear_flags(tfm, 2719 CRYPTO_TFM_REQ_FORBID_WEAK_KEYS); 2720 err = do_setkey(crypto_skcipher_setkey, tfm, vec->key, vec->klen, 2721 cfg, alignmask); 2722 if (err) { 2723 if (err == vec->setkey_error) 2724 return 0; 2725 pr_err("alg: skcipher: %s setkey failed on test vector %s; expected_error=%d, actual_error=%d, flags=%#x\n", 2726 driver, vec_name, vec->setkey_error, err, 2727 crypto_skcipher_get_flags(tfm)); 2728 return err; 2729 } 2730 if (vec->setkey_error) { 2731 pr_err("alg: skcipher: %s setkey unexpectedly succeeded on test vector %s; expected_error=%d\n", 2732 driver, vec_name, vec->setkey_error); 2733 return -EINVAL; 2734 } 2735 2736 /* The IV must be copied to a buffer, as the algorithm may modify it */ 2737 if (ivsize) { 2738 if (WARN_ON(ivsize > MAX_IVLEN)) 2739 return -EINVAL; 2740 if (vec->generates_iv && !enc) 2741 memcpy(iv, vec->iv_out, ivsize); 2742 else if (vec->iv) 2743 memcpy(iv, vec->iv, ivsize); 2744 else 2745 memset(iv, 0, ivsize); 2746 } else { 2747 if (vec->generates_iv) { 2748 pr_err("alg: skcipher: %s has ivsize=0 but test vector %s generates IV!\n", 2749 driver, vec_name); 2750 return -EINVAL; 2751 } 2752 iv = NULL; 2753 } 2754 2755 /* Build the src/dst scatterlists */ 2756 input.iov_base = enc ? (void *)vec->ptext : (void *)vec->ctext; 2757 input.iov_len = vec->len; 2758 err = build_cipher_test_sglists(tsgls, cfg, alignmask, 2759 vec->len, vec->len, &input, 1); 2760 if (err) { 2761 pr_err("alg: skcipher: %s %s: error preparing scatterlists for test vector %s, cfg=\"%s\"\n", 2762 driver, op, vec_name, cfg->name); 2763 return err; 2764 } 2765 2766 /* Do the actual encryption or decryption */ 2767 testmgr_poison(req->__ctx, crypto_skcipher_reqsize(tfm)); 2768 skcipher_request_set_callback(req, req_flags, crypto_req_done, &wait); 2769 skcipher_request_set_crypt(req, tsgls->src.sgl_ptr, tsgls->dst.sgl_ptr, 2770 vec->len, iv); 2771 if (cfg->nosimd) 2772 crypto_disable_simd_for_test(); 2773 err = enc ? crypto_skcipher_encrypt(req) : crypto_skcipher_decrypt(req); 2774 if (cfg->nosimd) 2775 crypto_reenable_simd_for_test(); 2776 err = crypto_wait_req(err, &wait); 2777 2778 /* Check that the algorithm didn't overwrite things it shouldn't have */ 2779 if (req->cryptlen != vec->len || 2780 req->iv != iv || 2781 req->src != tsgls->src.sgl_ptr || 2782 req->dst != tsgls->dst.sgl_ptr || 2783 crypto_skcipher_reqtfm(req) != tfm || 2784 req->base.complete != crypto_req_done || 2785 req->base.flags != req_flags || 2786 req->base.data != &wait) { 2787 pr_err("alg: skcipher: %s %s corrupted request struct on test vector %s, cfg=\"%s\"\n", 2788 driver, op, vec_name, cfg->name); 2789 if (req->cryptlen != vec->len) 2790 pr_err("alg: skcipher: changed 'req->cryptlen'\n"); 2791 if (req->iv != iv) 2792 pr_err("alg: skcipher: changed 'req->iv'\n"); 2793 if (req->src != tsgls->src.sgl_ptr) 2794 pr_err("alg: skcipher: changed 'req->src'\n"); 2795 if (req->dst != tsgls->dst.sgl_ptr) 2796 pr_err("alg: skcipher: changed 'req->dst'\n"); 2797 if (crypto_skcipher_reqtfm(req) != tfm) 2798 pr_err("alg: skcipher: changed 'req->base.tfm'\n"); 2799 if (req->base.complete != crypto_req_done) 2800 pr_err("alg: skcipher: changed 'req->base.complete'\n"); 2801 if (req->base.flags != req_flags) 2802 pr_err("alg: skcipher: changed 'req->base.flags'\n"); 2803 if (req->base.data != &wait) 2804 pr_err("alg: skcipher: changed 'req->base.data'\n"); 2805 return -EINVAL; 2806 } 2807 if (is_test_sglist_corrupted(&tsgls->src)) { 2808 pr_err("alg: skcipher: %s %s corrupted src sgl on test vector %s, cfg=\"%s\"\n", 2809 driver, op, vec_name, cfg->name); 2810 return -EINVAL; 2811 } 2812 if (tsgls->dst.sgl_ptr != tsgls->src.sgl && 2813 is_test_sglist_corrupted(&tsgls->dst)) { 2814 pr_err("alg: skcipher: %s %s corrupted dst sgl on test vector %s, cfg=\"%s\"\n", 2815 driver, op, vec_name, cfg->name); 2816 return -EINVAL; 2817 } 2818 2819 /* Check for success or failure */ 2820 if (err) { 2821 if (err == vec->crypt_error) 2822 return 0; 2823 pr_err("alg: skcipher: %s %s failed on test vector %s; expected_error=%d, actual_error=%d, cfg=\"%s\"\n", 2824 driver, op, vec_name, vec->crypt_error, err, cfg->name); 2825 return err; 2826 } 2827 if (vec->crypt_error) { 2828 pr_err("alg: skcipher: %s %s unexpectedly succeeded on test vector %s; expected_error=%d, cfg=\"%s\"\n", 2829 driver, op, vec_name, vec->crypt_error, cfg->name); 2830 return -EINVAL; 2831 } 2832 2833 /* Check for the correct output (ciphertext or plaintext) */ 2834 err = verify_correct_output(&tsgls->dst, enc ? vec->ctext : vec->ptext, 2835 vec->len, 0, true); 2836 if (err == -EOVERFLOW) { 2837 pr_err("alg: skcipher: %s %s overran dst buffer on test vector %s, cfg=\"%s\"\n", 2838 driver, op, vec_name, cfg->name); 2839 return err; 2840 } 2841 if (err) { 2842 pr_err("alg: skcipher: %s %s test failed (wrong result) on test vector %s, cfg=\"%s\"\n", 2843 driver, op, vec_name, cfg->name); 2844 return err; 2845 } 2846 2847 /* If applicable, check that the algorithm generated the correct IV */ 2848 if (vec->iv_out && memcmp(iv, vec->iv_out, ivsize) != 0) { 2849 pr_err("alg: skcipher: %s %s test failed (wrong output IV) on test vector %s, cfg=\"%s\"\n", 2850 driver, op, vec_name, cfg->name); 2851 hexdump(iv, ivsize); 2852 return -EINVAL; 2853 } 2854 2855 return 0; 2856 } 2857 2858 static int test_skcipher_vec(const char *driver, int enc, 2859 const struct cipher_testvec *vec, 2860 unsigned int vec_num, 2861 struct skcipher_request *req, 2862 struct cipher_test_sglists *tsgls) 2863 { 2864 char vec_name[16]; 2865 unsigned int i; 2866 int err; 2867 2868 if (fips_enabled && vec->fips_skip) 2869 return 0; 2870 2871 sprintf(vec_name, "%u", vec_num); 2872 2873 for (i = 0; i < ARRAY_SIZE(default_cipher_testvec_configs); i++) { 2874 err = test_skcipher_vec_cfg(driver, enc, vec, vec_name, 2875 &default_cipher_testvec_configs[i], 2876 req, tsgls); 2877 if (err) 2878 return err; 2879 } 2880 2881 #ifdef CONFIG_CRYPTO_MANAGER_EXTRA_TESTS 2882 if (!noextratests) { 2883 struct testvec_config cfg; 2884 char cfgname[TESTVEC_CONFIG_NAMELEN]; 2885 2886 for (i = 0; i < fuzz_iterations; i++) { 2887 generate_random_testvec_config(&cfg, cfgname, 2888 sizeof(cfgname)); 2889 err = test_skcipher_vec_cfg(driver, enc, vec, vec_name, 2890 &cfg, req, tsgls); 2891 if (err) 2892 return err; 2893 cond_resched(); 2894 } 2895 } 2896 #endif 2897 return 0; 2898 } 2899 2900 #ifdef CONFIG_CRYPTO_MANAGER_EXTRA_TESTS 2901 /* 2902 * Generate a symmetric cipher test vector from the given implementation. 2903 * Assumes the buffers in 'vec' were already allocated. 2904 */ 2905 static void generate_random_cipher_testvec(struct skcipher_request *req, 2906 struct cipher_testvec *vec, 2907 unsigned int maxdatasize, 2908 char *name, size_t max_namelen) 2909 { 2910 struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req); 2911 const unsigned int maxkeysize = crypto_skcipher_max_keysize(tfm); 2912 const unsigned int ivsize = crypto_skcipher_ivsize(tfm); 2913 struct scatterlist src, dst; 2914 u8 iv[MAX_IVLEN]; 2915 DECLARE_CRYPTO_WAIT(wait); 2916 2917 /* Key: length in [0, maxkeysize], but usually choose maxkeysize */ 2918 vec->klen = maxkeysize; 2919 if (prandom_u32() % 4 == 0) 2920 vec->klen = prandom_u32() % (maxkeysize + 1); 2921 generate_random_bytes((u8 *)vec->key, vec->klen); 2922 vec->setkey_error = crypto_skcipher_setkey(tfm, vec->key, vec->klen); 2923 2924 /* IV */ 2925 generate_random_bytes((u8 *)vec->iv, ivsize); 2926 2927 /* Plaintext */ 2928 vec->len = generate_random_length(maxdatasize); 2929 generate_random_bytes((u8 *)vec->ptext, vec->len); 2930 2931 /* If the key couldn't be set, no need to continue to encrypt. */ 2932 if (vec->setkey_error) 2933 goto done; 2934 2935 /* Ciphertext */ 2936 sg_init_one(&src, vec->ptext, vec->len); 2937 sg_init_one(&dst, vec->ctext, vec->len); 2938 memcpy(iv, vec->iv, ivsize); 2939 skcipher_request_set_callback(req, 0, crypto_req_done, &wait); 2940 skcipher_request_set_crypt(req, &src, &dst, vec->len, iv); 2941 vec->crypt_error = crypto_wait_req(crypto_skcipher_encrypt(req), &wait); 2942 if (vec->crypt_error != 0) { 2943 /* 2944 * The only acceptable error here is for an invalid length, so 2945 * skcipher decryption should fail with the same error too. 2946 * We'll test for this. But to keep the API usage well-defined, 2947 * explicitly initialize the ciphertext buffer too. 2948 */ 2949 memset((u8 *)vec->ctext, 0, vec->len); 2950 } 2951 done: 2952 snprintf(name, max_namelen, "\"random: len=%u klen=%u\"", 2953 vec->len, vec->klen); 2954 } 2955 2956 /* 2957 * Test the skcipher algorithm represented by @req against the corresponding 2958 * generic implementation, if one is available. 2959 */ 2960 static int test_skcipher_vs_generic_impl(const char *driver, 2961 const char *generic_driver, 2962 struct skcipher_request *req, 2963 struct cipher_test_sglists *tsgls) 2964 { 2965 struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req); 2966 const unsigned int maxkeysize = crypto_skcipher_max_keysize(tfm); 2967 const unsigned int ivsize = crypto_skcipher_ivsize(tfm); 2968 const unsigned int blocksize = crypto_skcipher_blocksize(tfm); 2969 const unsigned int maxdatasize = (2 * PAGE_SIZE) - TESTMGR_POISON_LEN; 2970 const char *algname = crypto_skcipher_alg(tfm)->base.cra_name; 2971 char _generic_driver[CRYPTO_MAX_ALG_NAME]; 2972 struct crypto_skcipher *generic_tfm = NULL; 2973 struct skcipher_request *generic_req = NULL; 2974 unsigned int i; 2975 struct cipher_testvec vec = { 0 }; 2976 char vec_name[64]; 2977 struct testvec_config *cfg; 2978 char cfgname[TESTVEC_CONFIG_NAMELEN]; 2979 int err; 2980 2981 if (noextratests) 2982 return 0; 2983 2984 /* Keywrap isn't supported here yet as it handles its IV differently. */ 2985 if (strncmp(algname, "kw(", 3) == 0) 2986 return 0; 2987 2988 if (!generic_driver) { /* Use default naming convention? */ 2989 err = build_generic_driver_name(algname, _generic_driver); 2990 if (err) 2991 return err; 2992 generic_driver = _generic_driver; 2993 } 2994 2995 if (strcmp(generic_driver, driver) == 0) /* Already the generic impl? */ 2996 return 0; 2997 2998 generic_tfm = crypto_alloc_skcipher(generic_driver, 0, 0); 2999 if (IS_ERR(generic_tfm)) { 3000 err = PTR_ERR(generic_tfm); 3001 if (err == -ENOENT) { 3002 pr_warn("alg: skcipher: skipping comparison tests for %s because %s is unavailable\n", 3003 driver, generic_driver); 3004 return 0; 3005 } 3006 pr_err("alg: skcipher: error allocating %s (generic impl of %s): %d\n", 3007 generic_driver, algname, err); 3008 return err; 3009 } 3010 3011 cfg = kzalloc(sizeof(*cfg), GFP_KERNEL); 3012 if (!cfg) { 3013 err = -ENOMEM; 3014 goto out; 3015 } 3016 3017 generic_req = skcipher_request_alloc(generic_tfm, GFP_KERNEL); 3018 if (!generic_req) { 3019 err = -ENOMEM; 3020 goto out; 3021 } 3022 3023 /* Check the algorithm properties for consistency. */ 3024 3025 if (crypto_skcipher_min_keysize(tfm) != 3026 crypto_skcipher_min_keysize(generic_tfm)) { 3027 pr_err("alg: skcipher: min keysize for %s (%u) doesn't match generic impl (%u)\n", 3028 driver, crypto_skcipher_min_keysize(tfm), 3029 crypto_skcipher_min_keysize(generic_tfm)); 3030 err = -EINVAL; 3031 goto out; 3032 } 3033 3034 if (maxkeysize != crypto_skcipher_max_keysize(generic_tfm)) { 3035 pr_err("alg: skcipher: max keysize for %s (%u) doesn't match generic impl (%u)\n", 3036 driver, maxkeysize, 3037 crypto_skcipher_max_keysize(generic_tfm)); 3038 err = -EINVAL; 3039 goto out; 3040 } 3041 3042 if (ivsize != crypto_skcipher_ivsize(generic_tfm)) { 3043 pr_err("alg: skcipher: ivsize for %s (%u) doesn't match generic impl (%u)\n", 3044 driver, ivsize, crypto_skcipher_ivsize(generic_tfm)); 3045 err = -EINVAL; 3046 goto out; 3047 } 3048 3049 if (blocksize != crypto_skcipher_blocksize(generic_tfm)) { 3050 pr_err("alg: skcipher: blocksize for %s (%u) doesn't match generic impl (%u)\n", 3051 driver, blocksize, 3052 crypto_skcipher_blocksize(generic_tfm)); 3053 err = -EINVAL; 3054 goto out; 3055 } 3056 3057 /* 3058 * Now generate test vectors using the generic implementation, and test 3059 * the other implementation against them. 3060 */ 3061 3062 vec.key = kmalloc(maxkeysize, GFP_KERNEL); 3063 vec.iv = kmalloc(ivsize, GFP_KERNEL); 3064 vec.ptext = kmalloc(maxdatasize, GFP_KERNEL); 3065 vec.ctext = kmalloc(maxdatasize, GFP_KERNEL); 3066 if (!vec.key || !vec.iv || !vec.ptext || !vec.ctext) { 3067 err = -ENOMEM; 3068 goto out; 3069 } 3070 3071 for (i = 0; i < fuzz_iterations * 8; i++) { 3072 generate_random_cipher_testvec(generic_req, &vec, maxdatasize, 3073 vec_name, sizeof(vec_name)); 3074 generate_random_testvec_config(cfg, cfgname, sizeof(cfgname)); 3075 3076 err = test_skcipher_vec_cfg(driver, ENCRYPT, &vec, vec_name, 3077 cfg, req, tsgls); 3078 if (err) 3079 goto out; 3080 err = test_skcipher_vec_cfg(driver, DECRYPT, &vec, vec_name, 3081 cfg, req, tsgls); 3082 if (err) 3083 goto out; 3084 cond_resched(); 3085 } 3086 err = 0; 3087 out: 3088 kfree(cfg); 3089 kfree(vec.key); 3090 kfree(vec.iv); 3091 kfree(vec.ptext); 3092 kfree(vec.ctext); 3093 crypto_free_skcipher(generic_tfm); 3094 skcipher_request_free(generic_req); 3095 return err; 3096 } 3097 #else /* !CONFIG_CRYPTO_MANAGER_EXTRA_TESTS */ 3098 static int test_skcipher_vs_generic_impl(const char *driver, 3099 const char *generic_driver, 3100 struct skcipher_request *req, 3101 struct cipher_test_sglists *tsgls) 3102 { 3103 return 0; 3104 } 3105 #endif /* !CONFIG_CRYPTO_MANAGER_EXTRA_TESTS */ 3106 3107 static int test_skcipher(const char *driver, int enc, 3108 const struct cipher_test_suite *suite, 3109 struct skcipher_request *req, 3110 struct cipher_test_sglists *tsgls) 3111 { 3112 unsigned int i; 3113 int err; 3114 3115 for (i = 0; i < suite->count; i++) { 3116 err = test_skcipher_vec(driver, enc, &suite->vecs[i], i, req, 3117 tsgls); 3118 if (err) 3119 return err; 3120 cond_resched(); 3121 } 3122 return 0; 3123 } 3124 3125 static int alg_test_skcipher(const struct alg_test_desc *desc, 3126 const char *driver, u32 type, u32 mask) 3127 { 3128 const struct cipher_test_suite *suite = &desc->suite.cipher; 3129 struct crypto_skcipher *tfm; 3130 struct skcipher_request *req = NULL; 3131 struct cipher_test_sglists *tsgls = NULL; 3132 int err; 3133 3134 if (suite->count <= 0) { 3135 pr_err("alg: skcipher: empty test suite for %s\n", driver); 3136 return -EINVAL; 3137 } 3138 3139 tfm = crypto_alloc_skcipher(driver, type, mask); 3140 if (IS_ERR(tfm)) { 3141 pr_err("alg: skcipher: failed to allocate transform for %s: %ld\n", 3142 driver, PTR_ERR(tfm)); 3143 return PTR_ERR(tfm); 3144 } 3145 3146 req = skcipher_request_alloc(tfm, GFP_KERNEL); 3147 if (!req) { 3148 pr_err("alg: skcipher: failed to allocate request for %s\n", 3149 driver); 3150 err = -ENOMEM; 3151 goto out; 3152 } 3153 3154 tsgls = alloc_cipher_test_sglists(); 3155 if (!tsgls) { 3156 pr_err("alg: skcipher: failed to allocate test buffers for %s\n", 3157 driver); 3158 err = -ENOMEM; 3159 goto out; 3160 } 3161 3162 err = test_skcipher(driver, ENCRYPT, suite, req, tsgls); 3163 if (err) 3164 goto out; 3165 3166 err = test_skcipher(driver, DECRYPT, suite, req, tsgls); 3167 if (err) 3168 goto out; 3169 3170 err = test_skcipher_vs_generic_impl(driver, desc->generic_driver, req, 3171 tsgls); 3172 out: 3173 free_cipher_test_sglists(tsgls); 3174 skcipher_request_free(req); 3175 crypto_free_skcipher(tfm); 3176 return err; 3177 } 3178 3179 static int test_comp(struct crypto_comp *tfm, 3180 const struct comp_testvec *ctemplate, 3181 const struct comp_testvec *dtemplate, 3182 int ctcount, int dtcount) 3183 { 3184 const char *algo = crypto_tfm_alg_driver_name(crypto_comp_tfm(tfm)); 3185 char *output, *decomp_output; 3186 unsigned int i; 3187 int ret; 3188 3189 output = kmalloc(COMP_BUF_SIZE, GFP_KERNEL); 3190 if (!output) 3191 return -ENOMEM; 3192 3193 decomp_output = kmalloc(COMP_BUF_SIZE, GFP_KERNEL); 3194 if (!decomp_output) { 3195 kfree(output); 3196 return -ENOMEM; 3197 } 3198 3199 for (i = 0; i < ctcount; i++) { 3200 int ilen; 3201 unsigned int dlen = COMP_BUF_SIZE; 3202 3203 memset(output, 0, COMP_BUF_SIZE); 3204 memset(decomp_output, 0, COMP_BUF_SIZE); 3205 3206 ilen = ctemplate[i].inlen; 3207 ret = crypto_comp_compress(tfm, ctemplate[i].input, 3208 ilen, output, &dlen); 3209 if (ret) { 3210 printk(KERN_ERR "alg: comp: compression failed " 3211 "on test %d for %s: ret=%d\n", i + 1, algo, 3212 -ret); 3213 goto out; 3214 } 3215 3216 ilen = dlen; 3217 dlen = COMP_BUF_SIZE; 3218 ret = crypto_comp_decompress(tfm, output, 3219 ilen, decomp_output, &dlen); 3220 if (ret) { 3221 pr_err("alg: comp: compression failed: decompress: on test %d for %s failed: ret=%d\n", 3222 i + 1, algo, -ret); 3223 goto out; 3224 } 3225 3226 if (dlen != ctemplate[i].inlen) { 3227 printk(KERN_ERR "alg: comp: Compression test %d " 3228 "failed for %s: output len = %d\n", i + 1, algo, 3229 dlen); 3230 ret = -EINVAL; 3231 goto out; 3232 } 3233 3234 if (memcmp(decomp_output, ctemplate[i].input, 3235 ctemplate[i].inlen)) { 3236 pr_err("alg: comp: compression failed: output differs: on test %d for %s\n", 3237 i + 1, algo); 3238 hexdump(decomp_output, dlen); 3239 ret = -EINVAL; 3240 goto out; 3241 } 3242 } 3243 3244 for (i = 0; i < dtcount; i++) { 3245 int ilen; 3246 unsigned int dlen = COMP_BUF_SIZE; 3247 3248 memset(decomp_output, 0, COMP_BUF_SIZE); 3249 3250 ilen = dtemplate[i].inlen; 3251 ret = crypto_comp_decompress(tfm, dtemplate[i].input, 3252 ilen, decomp_output, &dlen); 3253 if (ret) { 3254 printk(KERN_ERR "alg: comp: decompression failed " 3255 "on test %d for %s: ret=%d\n", i + 1, algo, 3256 -ret); 3257 goto out; 3258 } 3259 3260 if (dlen != dtemplate[i].outlen) { 3261 printk(KERN_ERR "alg: comp: Decompression test %d " 3262 "failed for %s: output len = %d\n", i + 1, algo, 3263 dlen); 3264 ret = -EINVAL; 3265 goto out; 3266 } 3267 3268 if (memcmp(decomp_output, dtemplate[i].output, dlen)) { 3269 printk(KERN_ERR "alg: comp: Decompression test %d " 3270 "failed for %s\n", i + 1, algo); 3271 hexdump(decomp_output, dlen); 3272 ret = -EINVAL; 3273 goto out; 3274 } 3275 } 3276 3277 ret = 0; 3278 3279 out: 3280 kfree(decomp_output); 3281 kfree(output); 3282 return ret; 3283 } 3284 3285 static int test_acomp(struct crypto_acomp *tfm, 3286 const struct comp_testvec *ctemplate, 3287 const struct comp_testvec *dtemplate, 3288 int ctcount, int dtcount) 3289 { 3290 const char *algo = crypto_tfm_alg_driver_name(crypto_acomp_tfm(tfm)); 3291 unsigned int i; 3292 char *output, *decomp_out; 3293 int ret; 3294 struct scatterlist src, dst; 3295 struct acomp_req *req; 3296 struct crypto_wait wait; 3297 3298 output = kmalloc(COMP_BUF_SIZE, GFP_KERNEL); 3299 if (!output) 3300 return -ENOMEM; 3301 3302 decomp_out = kmalloc(COMP_BUF_SIZE, GFP_KERNEL); 3303 if (!decomp_out) { 3304 kfree(output); 3305 return -ENOMEM; 3306 } 3307 3308 for (i = 0; i < ctcount; i++) { 3309 unsigned int dlen = COMP_BUF_SIZE; 3310 int ilen = ctemplate[i].inlen; 3311 void *input_vec; 3312 3313 input_vec = kmemdup(ctemplate[i].input, ilen, GFP_KERNEL); 3314 if (!input_vec) { 3315 ret = -ENOMEM; 3316 goto out; 3317 } 3318 3319 memset(output, 0, dlen); 3320 crypto_init_wait(&wait); 3321 sg_init_one(&src, input_vec, ilen); 3322 sg_init_one(&dst, output, dlen); 3323 3324 req = acomp_request_alloc(tfm); 3325 if (!req) { 3326 pr_err("alg: acomp: request alloc failed for %s\n", 3327 algo); 3328 kfree(input_vec); 3329 ret = -ENOMEM; 3330 goto out; 3331 } 3332 3333 acomp_request_set_params(req, &src, &dst, ilen, dlen); 3334 acomp_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG, 3335 crypto_req_done, &wait); 3336 3337 ret = crypto_wait_req(crypto_acomp_compress(req), &wait); 3338 if (ret) { 3339 pr_err("alg: acomp: compression failed on test %d for %s: ret=%d\n", 3340 i + 1, algo, -ret); 3341 kfree(input_vec); 3342 acomp_request_free(req); 3343 goto out; 3344 } 3345 3346 ilen = req->dlen; 3347 dlen = COMP_BUF_SIZE; 3348 sg_init_one(&src, output, ilen); 3349 sg_init_one(&dst, decomp_out, dlen); 3350 crypto_init_wait(&wait); 3351 acomp_request_set_params(req, &src, &dst, ilen, dlen); 3352 3353 ret = crypto_wait_req(crypto_acomp_decompress(req), &wait); 3354 if (ret) { 3355 pr_err("alg: acomp: compression failed on test %d for %s: ret=%d\n", 3356 i + 1, algo, -ret); 3357 kfree(input_vec); 3358 acomp_request_free(req); 3359 goto out; 3360 } 3361 3362 if (req->dlen != ctemplate[i].inlen) { 3363 pr_err("alg: acomp: Compression test %d failed for %s: output len = %d\n", 3364 i + 1, algo, req->dlen); 3365 ret = -EINVAL; 3366 kfree(input_vec); 3367 acomp_request_free(req); 3368 goto out; 3369 } 3370 3371 if (memcmp(input_vec, decomp_out, req->dlen)) { 3372 pr_err("alg: acomp: Compression test %d failed for %s\n", 3373 i + 1, algo); 3374 hexdump(output, req->dlen); 3375 ret = -EINVAL; 3376 kfree(input_vec); 3377 acomp_request_free(req); 3378 goto out; 3379 } 3380 3381 kfree(input_vec); 3382 acomp_request_free(req); 3383 } 3384 3385 for (i = 0; i < dtcount; i++) { 3386 unsigned int dlen = COMP_BUF_SIZE; 3387 int ilen = dtemplate[i].inlen; 3388 void *input_vec; 3389 3390 input_vec = kmemdup(dtemplate[i].input, ilen, GFP_KERNEL); 3391 if (!input_vec) { 3392 ret = -ENOMEM; 3393 goto out; 3394 } 3395 3396 memset(output, 0, dlen); 3397 crypto_init_wait(&wait); 3398 sg_init_one(&src, input_vec, ilen); 3399 sg_init_one(&dst, output, dlen); 3400 3401 req = acomp_request_alloc(tfm); 3402 if (!req) { 3403 pr_err("alg: acomp: request alloc failed for %s\n", 3404 algo); 3405 kfree(input_vec); 3406 ret = -ENOMEM; 3407 goto out; 3408 } 3409 3410 acomp_request_set_params(req, &src, &dst, ilen, dlen); 3411 acomp_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG, 3412 crypto_req_done, &wait); 3413 3414 ret = crypto_wait_req(crypto_acomp_decompress(req), &wait); 3415 if (ret) { 3416 pr_err("alg: acomp: decompression failed on test %d for %s: ret=%d\n", 3417 i + 1, algo, -ret); 3418 kfree(input_vec); 3419 acomp_request_free(req); 3420 goto out; 3421 } 3422 3423 if (req->dlen != dtemplate[i].outlen) { 3424 pr_err("alg: acomp: Decompression test %d failed for %s: output len = %d\n", 3425 i + 1, algo, req->dlen); 3426 ret = -EINVAL; 3427 kfree(input_vec); 3428 acomp_request_free(req); 3429 goto out; 3430 } 3431 3432 if (memcmp(output, dtemplate[i].output, req->dlen)) { 3433 pr_err("alg: acomp: Decompression test %d failed for %s\n", 3434 i + 1, algo); 3435 hexdump(output, req->dlen); 3436 ret = -EINVAL; 3437 kfree(input_vec); 3438 acomp_request_free(req); 3439 goto out; 3440 } 3441 3442 kfree(input_vec); 3443 acomp_request_free(req); 3444 } 3445 3446 ret = 0; 3447 3448 out: 3449 kfree(decomp_out); 3450 kfree(output); 3451 return ret; 3452 } 3453 3454 static int test_cprng(struct crypto_rng *tfm, 3455 const struct cprng_testvec *template, 3456 unsigned int tcount) 3457 { 3458 const char *algo = crypto_tfm_alg_driver_name(crypto_rng_tfm(tfm)); 3459 int err = 0, i, j, seedsize; 3460 u8 *seed; 3461 char result[32]; 3462 3463 seedsize = crypto_rng_seedsize(tfm); 3464 3465 seed = kmalloc(seedsize, GFP_KERNEL); 3466 if (!seed) { 3467 printk(KERN_ERR "alg: cprng: Failed to allocate seed space " 3468 "for %s\n", algo); 3469 return -ENOMEM; 3470 } 3471 3472 for (i = 0; i < tcount; i++) { 3473 memset(result, 0, 32); 3474 3475 memcpy(seed, template[i].v, template[i].vlen); 3476 memcpy(seed + template[i].vlen, template[i].key, 3477 template[i].klen); 3478 memcpy(seed + template[i].vlen + template[i].klen, 3479 template[i].dt, template[i].dtlen); 3480 3481 err = crypto_rng_reset(tfm, seed, seedsize); 3482 if (err) { 3483 printk(KERN_ERR "alg: cprng: Failed to reset rng " 3484 "for %s\n", algo); 3485 goto out; 3486 } 3487 3488 for (j = 0; j < template[i].loops; j++) { 3489 err = crypto_rng_get_bytes(tfm, result, 3490 template[i].rlen); 3491 if (err < 0) { 3492 printk(KERN_ERR "alg: cprng: Failed to obtain " 3493 "the correct amount of random data for " 3494 "%s (requested %d)\n", algo, 3495 template[i].rlen); 3496 goto out; 3497 } 3498 } 3499 3500 err = memcmp(result, template[i].result, 3501 template[i].rlen); 3502 if (err) { 3503 printk(KERN_ERR "alg: cprng: Test %d failed for %s\n", 3504 i, algo); 3505 hexdump(result, template[i].rlen); 3506 err = -EINVAL; 3507 goto out; 3508 } 3509 } 3510 3511 out: 3512 kfree(seed); 3513 return err; 3514 } 3515 3516 static int alg_test_cipher(const struct alg_test_desc *desc, 3517 const char *driver, u32 type, u32 mask) 3518 { 3519 const struct cipher_test_suite *suite = &desc->suite.cipher; 3520 struct crypto_cipher *tfm; 3521 int err; 3522 3523 tfm = crypto_alloc_cipher(driver, type, mask); 3524 if (IS_ERR(tfm)) { 3525 printk(KERN_ERR "alg: cipher: Failed to load transform for " 3526 "%s: %ld\n", driver, PTR_ERR(tfm)); 3527 return PTR_ERR(tfm); 3528 } 3529 3530 err = test_cipher(tfm, ENCRYPT, suite->vecs, suite->count); 3531 if (!err) 3532 err = test_cipher(tfm, DECRYPT, suite->vecs, suite->count); 3533 3534 crypto_free_cipher(tfm); 3535 return err; 3536 } 3537 3538 static int alg_test_comp(const struct alg_test_desc *desc, const char *driver, 3539 u32 type, u32 mask) 3540 { 3541 struct crypto_comp *comp; 3542 struct crypto_acomp *acomp; 3543 int err; 3544 u32 algo_type = type & CRYPTO_ALG_TYPE_ACOMPRESS_MASK; 3545 3546 if (algo_type == CRYPTO_ALG_TYPE_ACOMPRESS) { 3547 acomp = crypto_alloc_acomp(driver, type, mask); 3548 if (IS_ERR(acomp)) { 3549 pr_err("alg: acomp: Failed to load transform for %s: %ld\n", 3550 driver, PTR_ERR(acomp)); 3551 return PTR_ERR(acomp); 3552 } 3553 err = test_acomp(acomp, desc->suite.comp.comp.vecs, 3554 desc->suite.comp.decomp.vecs, 3555 desc->suite.comp.comp.count, 3556 desc->suite.comp.decomp.count); 3557 crypto_free_acomp(acomp); 3558 } else { 3559 comp = crypto_alloc_comp(driver, type, mask); 3560 if (IS_ERR(comp)) { 3561 pr_err("alg: comp: Failed to load transform for %s: %ld\n", 3562 driver, PTR_ERR(comp)); 3563 return PTR_ERR(comp); 3564 } 3565 3566 err = test_comp(comp, desc->suite.comp.comp.vecs, 3567 desc->suite.comp.decomp.vecs, 3568 desc->suite.comp.comp.count, 3569 desc->suite.comp.decomp.count); 3570 3571 crypto_free_comp(comp); 3572 } 3573 return err; 3574 } 3575 3576 static int alg_test_crc32c(const struct alg_test_desc *desc, 3577 const char *driver, u32 type, u32 mask) 3578 { 3579 struct crypto_shash *tfm; 3580 __le32 val; 3581 int err; 3582 3583 err = alg_test_hash(desc, driver, type, mask); 3584 if (err) 3585 return err; 3586 3587 tfm = crypto_alloc_shash(driver, type, mask); 3588 if (IS_ERR(tfm)) { 3589 if (PTR_ERR(tfm) == -ENOENT) { 3590 /* 3591 * This crc32c implementation is only available through 3592 * ahash API, not the shash API, so the remaining part 3593 * of the test is not applicable to it. 3594 */ 3595 return 0; 3596 } 3597 printk(KERN_ERR "alg: crc32c: Failed to load transform for %s: " 3598 "%ld\n", driver, PTR_ERR(tfm)); 3599 return PTR_ERR(tfm); 3600 } 3601 driver = crypto_shash_driver_name(tfm); 3602 3603 do { 3604 SHASH_DESC_ON_STACK(shash, tfm); 3605 u32 *ctx = (u32 *)shash_desc_ctx(shash); 3606 3607 shash->tfm = tfm; 3608 3609 *ctx = 420553207; 3610 err = crypto_shash_final(shash, (u8 *)&val); 3611 if (err) { 3612 printk(KERN_ERR "alg: crc32c: Operation failed for " 3613 "%s: %d\n", driver, err); 3614 break; 3615 } 3616 3617 if (val != cpu_to_le32(~420553207)) { 3618 pr_err("alg: crc32c: Test failed for %s: %u\n", 3619 driver, le32_to_cpu(val)); 3620 err = -EINVAL; 3621 } 3622 } while (0); 3623 3624 crypto_free_shash(tfm); 3625 3626 return err; 3627 } 3628 3629 static int alg_test_cprng(const struct alg_test_desc *desc, const char *driver, 3630 u32 type, u32 mask) 3631 { 3632 struct crypto_rng *rng; 3633 int err; 3634 3635 rng = crypto_alloc_rng(driver, type, mask); 3636 if (IS_ERR(rng)) { 3637 printk(KERN_ERR "alg: cprng: Failed to load transform for %s: " 3638 "%ld\n", driver, PTR_ERR(rng)); 3639 return PTR_ERR(rng); 3640 } 3641 3642 err = test_cprng(rng, desc->suite.cprng.vecs, desc->suite.cprng.count); 3643 3644 crypto_free_rng(rng); 3645 3646 return err; 3647 } 3648 3649 3650 static int drbg_cavs_test(const struct drbg_testvec *test, int pr, 3651 const char *driver, u32 type, u32 mask) 3652 { 3653 int ret = -EAGAIN; 3654 struct crypto_rng *drng; 3655 struct drbg_test_data test_data; 3656 struct drbg_string addtl, pers, testentropy; 3657 unsigned char *buf = kzalloc(test->expectedlen, GFP_KERNEL); 3658 3659 if (!buf) 3660 return -ENOMEM; 3661 3662 drng = crypto_alloc_rng(driver, type, mask); 3663 if (IS_ERR(drng)) { 3664 printk(KERN_ERR "alg: drbg: could not allocate DRNG handle for " 3665 "%s\n", driver); 3666 kfree_sensitive(buf); 3667 return -ENOMEM; 3668 } 3669 3670 test_data.testentropy = &testentropy; 3671 drbg_string_fill(&testentropy, test->entropy, test->entropylen); 3672 drbg_string_fill(&pers, test->pers, test->perslen); 3673 ret = crypto_drbg_reset_test(drng, &pers, &test_data); 3674 if (ret) { 3675 printk(KERN_ERR "alg: drbg: Failed to reset rng\n"); 3676 goto outbuf; 3677 } 3678 3679 drbg_string_fill(&addtl, test->addtla, test->addtllen); 3680 if (pr) { 3681 drbg_string_fill(&testentropy, test->entpra, test->entprlen); 3682 ret = crypto_drbg_get_bytes_addtl_test(drng, 3683 buf, test->expectedlen, &addtl, &test_data); 3684 } else { 3685 ret = crypto_drbg_get_bytes_addtl(drng, 3686 buf, test->expectedlen, &addtl); 3687 } 3688 if (ret < 0) { 3689 printk(KERN_ERR "alg: drbg: could not obtain random data for " 3690 "driver %s\n", driver); 3691 goto outbuf; 3692 } 3693 3694 drbg_string_fill(&addtl, test->addtlb, test->addtllen); 3695 if (pr) { 3696 drbg_string_fill(&testentropy, test->entprb, test->entprlen); 3697 ret = crypto_drbg_get_bytes_addtl_test(drng, 3698 buf, test->expectedlen, &addtl, &test_data); 3699 } else { 3700 ret = crypto_drbg_get_bytes_addtl(drng, 3701 buf, test->expectedlen, &addtl); 3702 } 3703 if (ret < 0) { 3704 printk(KERN_ERR "alg: drbg: could not obtain random data for " 3705 "driver %s\n", driver); 3706 goto outbuf; 3707 } 3708 3709 ret = memcmp(test->expected, buf, test->expectedlen); 3710 3711 outbuf: 3712 crypto_free_rng(drng); 3713 kfree_sensitive(buf); 3714 return ret; 3715 } 3716 3717 3718 static int alg_test_drbg(const struct alg_test_desc *desc, const char *driver, 3719 u32 type, u32 mask) 3720 { 3721 int err = 0; 3722 int pr = 0; 3723 int i = 0; 3724 const struct drbg_testvec *template = desc->suite.drbg.vecs; 3725 unsigned int tcount = desc->suite.drbg.count; 3726 3727 if (0 == memcmp(driver, "drbg_pr_", 8)) 3728 pr = 1; 3729 3730 for (i = 0; i < tcount; i++) { 3731 err = drbg_cavs_test(&template[i], pr, driver, type, mask); 3732 if (err) { 3733 printk(KERN_ERR "alg: drbg: Test %d failed for %s\n", 3734 i, driver); 3735 err = -EINVAL; 3736 break; 3737 } 3738 } 3739 return err; 3740 3741 } 3742 3743 static int do_test_kpp(struct crypto_kpp *tfm, const struct kpp_testvec *vec, 3744 const char *alg) 3745 { 3746 struct kpp_request *req; 3747 void *input_buf = NULL; 3748 void *output_buf = NULL; 3749 void *a_public = NULL; 3750 void *a_ss = NULL; 3751 void *shared_secret = NULL; 3752 struct crypto_wait wait; 3753 unsigned int out_len_max; 3754 int err = -ENOMEM; 3755 struct scatterlist src, dst; 3756 3757 req = kpp_request_alloc(tfm, GFP_KERNEL); 3758 if (!req) 3759 return err; 3760 3761 crypto_init_wait(&wait); 3762 3763 err = crypto_kpp_set_secret(tfm, vec->secret, vec->secret_size); 3764 if (err < 0) 3765 goto free_req; 3766 3767 out_len_max = crypto_kpp_maxsize(tfm); 3768 output_buf = kzalloc(out_len_max, GFP_KERNEL); 3769 if (!output_buf) { 3770 err = -ENOMEM; 3771 goto free_req; 3772 } 3773 3774 /* Use appropriate parameter as base */ 3775 kpp_request_set_input(req, NULL, 0); 3776 sg_init_one(&dst, output_buf, out_len_max); 3777 kpp_request_set_output(req, &dst, out_len_max); 3778 kpp_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG, 3779 crypto_req_done, &wait); 3780 3781 /* Compute party A's public key */ 3782 err = crypto_wait_req(crypto_kpp_generate_public_key(req), &wait); 3783 if (err) { 3784 pr_err("alg: %s: Party A: generate public key test failed. err %d\n", 3785 alg, err); 3786 goto free_output; 3787 } 3788 3789 if (vec->genkey) { 3790 /* Save party A's public key */ 3791 a_public = kmemdup(sg_virt(req->dst), out_len_max, GFP_KERNEL); 3792 if (!a_public) { 3793 err = -ENOMEM; 3794 goto free_output; 3795 } 3796 } else { 3797 /* Verify calculated public key */ 3798 if (memcmp(vec->expected_a_public, sg_virt(req->dst), 3799 vec->expected_a_public_size)) { 3800 pr_err("alg: %s: Party A: generate public key test failed. Invalid output\n", 3801 alg); 3802 err = -EINVAL; 3803 goto free_output; 3804 } 3805 } 3806 3807 /* Calculate shared secret key by using counter part (b) public key. */ 3808 input_buf = kmemdup(vec->b_public, vec->b_public_size, GFP_KERNEL); 3809 if (!input_buf) { 3810 err = -ENOMEM; 3811 goto free_output; 3812 } 3813 3814 sg_init_one(&src, input_buf, vec->b_public_size); 3815 sg_init_one(&dst, output_buf, out_len_max); 3816 kpp_request_set_input(req, &src, vec->b_public_size); 3817 kpp_request_set_output(req, &dst, out_len_max); 3818 kpp_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG, 3819 crypto_req_done, &wait); 3820 err = crypto_wait_req(crypto_kpp_compute_shared_secret(req), &wait); 3821 if (err) { 3822 pr_err("alg: %s: Party A: compute shared secret test failed. err %d\n", 3823 alg, err); 3824 goto free_all; 3825 } 3826 3827 if (vec->genkey) { 3828 /* Save the shared secret obtained by party A */ 3829 a_ss = kmemdup(sg_virt(req->dst), vec->expected_ss_size, GFP_KERNEL); 3830 if (!a_ss) { 3831 err = -ENOMEM; 3832 goto free_all; 3833 } 3834 3835 /* 3836 * Calculate party B's shared secret by using party A's 3837 * public key. 3838 */ 3839 err = crypto_kpp_set_secret(tfm, vec->b_secret, 3840 vec->b_secret_size); 3841 if (err < 0) 3842 goto free_all; 3843 3844 sg_init_one(&src, a_public, vec->expected_a_public_size); 3845 sg_init_one(&dst, output_buf, out_len_max); 3846 kpp_request_set_input(req, &src, vec->expected_a_public_size); 3847 kpp_request_set_output(req, &dst, out_len_max); 3848 kpp_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG, 3849 crypto_req_done, &wait); 3850 err = crypto_wait_req(crypto_kpp_compute_shared_secret(req), 3851 &wait); 3852 if (err) { 3853 pr_err("alg: %s: Party B: compute shared secret failed. err %d\n", 3854 alg, err); 3855 goto free_all; 3856 } 3857 3858 shared_secret = a_ss; 3859 } else { 3860 shared_secret = (void *)vec->expected_ss; 3861 } 3862 3863 /* 3864 * verify shared secret from which the user will derive 3865 * secret key by executing whatever hash it has chosen 3866 */ 3867 if (memcmp(shared_secret, sg_virt(req->dst), 3868 vec->expected_ss_size)) { 3869 pr_err("alg: %s: compute shared secret test failed. Invalid output\n", 3870 alg); 3871 err = -EINVAL; 3872 } 3873 3874 free_all: 3875 kfree(a_ss); 3876 kfree(input_buf); 3877 free_output: 3878 kfree(a_public); 3879 kfree(output_buf); 3880 free_req: 3881 kpp_request_free(req); 3882 return err; 3883 } 3884 3885 static int test_kpp(struct crypto_kpp *tfm, const char *alg, 3886 const struct kpp_testvec *vecs, unsigned int tcount) 3887 { 3888 int ret, i; 3889 3890 for (i = 0; i < tcount; i++) { 3891 ret = do_test_kpp(tfm, vecs++, alg); 3892 if (ret) { 3893 pr_err("alg: %s: test failed on vector %d, err=%d\n", 3894 alg, i + 1, ret); 3895 return ret; 3896 } 3897 } 3898 return 0; 3899 } 3900 3901 static int alg_test_kpp(const struct alg_test_desc *desc, const char *driver, 3902 u32 type, u32 mask) 3903 { 3904 struct crypto_kpp *tfm; 3905 int err = 0; 3906 3907 tfm = crypto_alloc_kpp(driver, type, mask); 3908 if (IS_ERR(tfm)) { 3909 pr_err("alg: kpp: Failed to load tfm for %s: %ld\n", 3910 driver, PTR_ERR(tfm)); 3911 return PTR_ERR(tfm); 3912 } 3913 if (desc->suite.kpp.vecs) 3914 err = test_kpp(tfm, desc->alg, desc->suite.kpp.vecs, 3915 desc->suite.kpp.count); 3916 3917 crypto_free_kpp(tfm); 3918 return err; 3919 } 3920 3921 static u8 *test_pack_u32(u8 *dst, u32 val) 3922 { 3923 memcpy(dst, &val, sizeof(val)); 3924 return dst + sizeof(val); 3925 } 3926 3927 static int test_akcipher_one(struct crypto_akcipher *tfm, 3928 const struct akcipher_testvec *vecs) 3929 { 3930 char *xbuf[XBUFSIZE]; 3931 struct akcipher_request *req; 3932 void *outbuf_enc = NULL; 3933 void *outbuf_dec = NULL; 3934 struct crypto_wait wait; 3935 unsigned int out_len_max, out_len = 0; 3936 int err = -ENOMEM; 3937 struct scatterlist src, dst, src_tab[3]; 3938 const char *m, *c; 3939 unsigned int m_size, c_size; 3940 const char *op; 3941 u8 *key, *ptr; 3942 3943 if (testmgr_alloc_buf(xbuf)) 3944 return err; 3945 3946 req = akcipher_request_alloc(tfm, GFP_KERNEL); 3947 if (!req) 3948 goto free_xbuf; 3949 3950 crypto_init_wait(&wait); 3951 3952 key = kmalloc(vecs->key_len + sizeof(u32) * 2 + vecs->param_len, 3953 GFP_KERNEL); 3954 if (!key) 3955 goto free_req; 3956 memcpy(key, vecs->key, vecs->key_len); 3957 ptr = key + vecs->key_len; 3958 ptr = test_pack_u32(ptr, vecs->algo); 3959 ptr = test_pack_u32(ptr, vecs->param_len); 3960 memcpy(ptr, vecs->params, vecs->param_len); 3961 3962 if (vecs->public_key_vec) 3963 err = crypto_akcipher_set_pub_key(tfm, key, vecs->key_len); 3964 else 3965 err = crypto_akcipher_set_priv_key(tfm, key, vecs->key_len); 3966 if (err) 3967 goto free_key; 3968 3969 /* 3970 * First run test which do not require a private key, such as 3971 * encrypt or verify. 3972 */ 3973 err = -ENOMEM; 3974 out_len_max = crypto_akcipher_maxsize(tfm); 3975 outbuf_enc = kzalloc(out_len_max, GFP_KERNEL); 3976 if (!outbuf_enc) 3977 goto free_key; 3978 3979 if (!vecs->siggen_sigver_test) { 3980 m = vecs->m; 3981 m_size = vecs->m_size; 3982 c = vecs->c; 3983 c_size = vecs->c_size; 3984 op = "encrypt"; 3985 } else { 3986 /* Swap args so we could keep plaintext (digest) 3987 * in vecs->m, and cooked signature in vecs->c. 3988 */ 3989 m = vecs->c; /* signature */ 3990 m_size = vecs->c_size; 3991 c = vecs->m; /* digest */ 3992 c_size = vecs->m_size; 3993 op = "verify"; 3994 } 3995 3996 err = -E2BIG; 3997 if (WARN_ON(m_size > PAGE_SIZE)) 3998 goto free_all; 3999 memcpy(xbuf[0], m, m_size); 4000 4001 sg_init_table(src_tab, 3); 4002 sg_set_buf(&src_tab[0], xbuf[0], 8); 4003 sg_set_buf(&src_tab[1], xbuf[0] + 8, m_size - 8); 4004 if (vecs->siggen_sigver_test) { 4005 if (WARN_ON(c_size > PAGE_SIZE)) 4006 goto free_all; 4007 memcpy(xbuf[1], c, c_size); 4008 sg_set_buf(&src_tab[2], xbuf[1], c_size); 4009 akcipher_request_set_crypt(req, src_tab, NULL, m_size, c_size); 4010 } else { 4011 sg_init_one(&dst, outbuf_enc, out_len_max); 4012 akcipher_request_set_crypt(req, src_tab, &dst, m_size, 4013 out_len_max); 4014 } 4015 akcipher_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG, 4016 crypto_req_done, &wait); 4017 4018 err = crypto_wait_req(vecs->siggen_sigver_test ? 4019 /* Run asymmetric signature verification */ 4020 crypto_akcipher_verify(req) : 4021 /* Run asymmetric encrypt */ 4022 crypto_akcipher_encrypt(req), &wait); 4023 if (err) { 4024 pr_err("alg: akcipher: %s test failed. err %d\n", op, err); 4025 goto free_all; 4026 } 4027 if (!vecs->siggen_sigver_test && c) { 4028 if (req->dst_len != c_size) { 4029 pr_err("alg: akcipher: %s test failed. Invalid output len\n", 4030 op); 4031 err = -EINVAL; 4032 goto free_all; 4033 } 4034 /* verify that encrypted message is equal to expected */ 4035 if (memcmp(c, outbuf_enc, c_size) != 0) { 4036 pr_err("alg: akcipher: %s test failed. Invalid output\n", 4037 op); 4038 hexdump(outbuf_enc, c_size); 4039 err = -EINVAL; 4040 goto free_all; 4041 } 4042 } 4043 4044 /* 4045 * Don't invoke (decrypt or sign) test which require a private key 4046 * for vectors with only a public key. 4047 */ 4048 if (vecs->public_key_vec) { 4049 err = 0; 4050 goto free_all; 4051 } 4052 outbuf_dec = kzalloc(out_len_max, GFP_KERNEL); 4053 if (!outbuf_dec) { 4054 err = -ENOMEM; 4055 goto free_all; 4056 } 4057 4058 if (!vecs->siggen_sigver_test && !c) { 4059 c = outbuf_enc; 4060 c_size = req->dst_len; 4061 } 4062 4063 err = -E2BIG; 4064 op = vecs->siggen_sigver_test ? "sign" : "decrypt"; 4065 if (WARN_ON(c_size > PAGE_SIZE)) 4066 goto free_all; 4067 memcpy(xbuf[0], c, c_size); 4068 4069 sg_init_one(&src, xbuf[0], c_size); 4070 sg_init_one(&dst, outbuf_dec, out_len_max); 4071 crypto_init_wait(&wait); 4072 akcipher_request_set_crypt(req, &src, &dst, c_size, out_len_max); 4073 4074 err = crypto_wait_req(vecs->siggen_sigver_test ? 4075 /* Run asymmetric signature generation */ 4076 crypto_akcipher_sign(req) : 4077 /* Run asymmetric decrypt */ 4078 crypto_akcipher_decrypt(req), &wait); 4079 if (err) { 4080 pr_err("alg: akcipher: %s test failed. err %d\n", op, err); 4081 goto free_all; 4082 } 4083 out_len = req->dst_len; 4084 if (out_len < m_size) { 4085 pr_err("alg: akcipher: %s test failed. Invalid output len %u\n", 4086 op, out_len); 4087 err = -EINVAL; 4088 goto free_all; 4089 } 4090 /* verify that decrypted message is equal to the original msg */ 4091 if (memchr_inv(outbuf_dec, 0, out_len - m_size) || 4092 memcmp(m, outbuf_dec + out_len - m_size, m_size)) { 4093 pr_err("alg: akcipher: %s test failed. Invalid output\n", op); 4094 hexdump(outbuf_dec, out_len); 4095 err = -EINVAL; 4096 } 4097 free_all: 4098 kfree(outbuf_dec); 4099 kfree(outbuf_enc); 4100 free_key: 4101 kfree(key); 4102 free_req: 4103 akcipher_request_free(req); 4104 free_xbuf: 4105 testmgr_free_buf(xbuf); 4106 return err; 4107 } 4108 4109 static int test_akcipher(struct crypto_akcipher *tfm, const char *alg, 4110 const struct akcipher_testvec *vecs, 4111 unsigned int tcount) 4112 { 4113 const char *algo = 4114 crypto_tfm_alg_driver_name(crypto_akcipher_tfm(tfm)); 4115 int ret, i; 4116 4117 for (i = 0; i < tcount; i++) { 4118 ret = test_akcipher_one(tfm, vecs++); 4119 if (!ret) 4120 continue; 4121 4122 pr_err("alg: akcipher: test %d failed for %s, err=%d\n", 4123 i + 1, algo, ret); 4124 return ret; 4125 } 4126 return 0; 4127 } 4128 4129 static int alg_test_akcipher(const struct alg_test_desc *desc, 4130 const char *driver, u32 type, u32 mask) 4131 { 4132 struct crypto_akcipher *tfm; 4133 int err = 0; 4134 4135 tfm = crypto_alloc_akcipher(driver, type, mask); 4136 if (IS_ERR(tfm)) { 4137 pr_err("alg: akcipher: Failed to load tfm for %s: %ld\n", 4138 driver, PTR_ERR(tfm)); 4139 return PTR_ERR(tfm); 4140 } 4141 if (desc->suite.akcipher.vecs) 4142 err = test_akcipher(tfm, desc->alg, desc->suite.akcipher.vecs, 4143 desc->suite.akcipher.count); 4144 4145 crypto_free_akcipher(tfm); 4146 return err; 4147 } 4148 4149 static int alg_test_null(const struct alg_test_desc *desc, 4150 const char *driver, u32 type, u32 mask) 4151 { 4152 return 0; 4153 } 4154 4155 #define ____VECS(tv) .vecs = tv, .count = ARRAY_SIZE(tv) 4156 #define __VECS(tv) { ____VECS(tv) } 4157 4158 /* Please keep this list sorted by algorithm name. */ 4159 static const struct alg_test_desc alg_test_descs[] = { 4160 { 4161 .alg = "adiantum(xchacha12,aes)", 4162 .generic_driver = "adiantum(xchacha12-generic,aes-generic,nhpoly1305-generic)", 4163 .test = alg_test_skcipher, 4164 .suite = { 4165 .cipher = __VECS(adiantum_xchacha12_aes_tv_template) 4166 }, 4167 }, { 4168 .alg = "adiantum(xchacha20,aes)", 4169 .generic_driver = "adiantum(xchacha20-generic,aes-generic,nhpoly1305-generic)", 4170 .test = alg_test_skcipher, 4171 .suite = { 4172 .cipher = __VECS(adiantum_xchacha20_aes_tv_template) 4173 }, 4174 }, { 4175 .alg = "aegis128", 4176 .test = alg_test_aead, 4177 .suite = { 4178 .aead = __VECS(aegis128_tv_template) 4179 } 4180 }, { 4181 .alg = "ansi_cprng", 4182 .test = alg_test_cprng, 4183 .suite = { 4184 .cprng = __VECS(ansi_cprng_aes_tv_template) 4185 } 4186 }, { 4187 .alg = "authenc(hmac(md5),ecb(cipher_null))", 4188 .test = alg_test_aead, 4189 .suite = { 4190 .aead = __VECS(hmac_md5_ecb_cipher_null_tv_template) 4191 } 4192 }, { 4193 .alg = "authenc(hmac(sha1),cbc(aes))", 4194 .test = alg_test_aead, 4195 .fips_allowed = 1, 4196 .suite = { 4197 .aead = __VECS(hmac_sha1_aes_cbc_tv_temp) 4198 } 4199 }, { 4200 .alg = "authenc(hmac(sha1),cbc(des))", 4201 .test = alg_test_aead, 4202 .suite = { 4203 .aead = __VECS(hmac_sha1_des_cbc_tv_temp) 4204 } 4205 }, { 4206 .alg = "authenc(hmac(sha1),cbc(des3_ede))", 4207 .test = alg_test_aead, 4208 .fips_allowed = 1, 4209 .suite = { 4210 .aead = __VECS(hmac_sha1_des3_ede_cbc_tv_temp) 4211 } 4212 }, { 4213 .alg = "authenc(hmac(sha1),ctr(aes))", 4214 .test = alg_test_null, 4215 .fips_allowed = 1, 4216 }, { 4217 .alg = "authenc(hmac(sha1),ecb(cipher_null))", 4218 .test = alg_test_aead, 4219 .suite = { 4220 .aead = __VECS(hmac_sha1_ecb_cipher_null_tv_temp) 4221 } 4222 }, { 4223 .alg = "authenc(hmac(sha1),rfc3686(ctr(aes)))", 4224 .test = alg_test_null, 4225 .fips_allowed = 1, 4226 }, { 4227 .alg = "authenc(hmac(sha224),cbc(des))", 4228 .test = alg_test_aead, 4229 .suite = { 4230 .aead = __VECS(hmac_sha224_des_cbc_tv_temp) 4231 } 4232 }, { 4233 .alg = "authenc(hmac(sha224),cbc(des3_ede))", 4234 .test = alg_test_aead, 4235 .fips_allowed = 1, 4236 .suite = { 4237 .aead = __VECS(hmac_sha224_des3_ede_cbc_tv_temp) 4238 } 4239 }, { 4240 .alg = "authenc(hmac(sha256),cbc(aes))", 4241 .test = alg_test_aead, 4242 .fips_allowed = 1, 4243 .suite = { 4244 .aead = __VECS(hmac_sha256_aes_cbc_tv_temp) 4245 } 4246 }, { 4247 .alg = "authenc(hmac(sha256),cbc(des))", 4248 .test = alg_test_aead, 4249 .suite = { 4250 .aead = __VECS(hmac_sha256_des_cbc_tv_temp) 4251 } 4252 }, { 4253 .alg = "authenc(hmac(sha256),cbc(des3_ede))", 4254 .test = alg_test_aead, 4255 .fips_allowed = 1, 4256 .suite = { 4257 .aead = __VECS(hmac_sha256_des3_ede_cbc_tv_temp) 4258 } 4259 }, { 4260 .alg = "authenc(hmac(sha256),ctr(aes))", 4261 .test = alg_test_null, 4262 .fips_allowed = 1, 4263 }, { 4264 .alg = "authenc(hmac(sha256),rfc3686(ctr(aes)))", 4265 .test = alg_test_null, 4266 .fips_allowed = 1, 4267 }, { 4268 .alg = "authenc(hmac(sha384),cbc(des))", 4269 .test = alg_test_aead, 4270 .suite = { 4271 .aead = __VECS(hmac_sha384_des_cbc_tv_temp) 4272 } 4273 }, { 4274 .alg = "authenc(hmac(sha384),cbc(des3_ede))", 4275 .test = alg_test_aead, 4276 .fips_allowed = 1, 4277 .suite = { 4278 .aead = __VECS(hmac_sha384_des3_ede_cbc_tv_temp) 4279 } 4280 }, { 4281 .alg = "authenc(hmac(sha384),ctr(aes))", 4282 .test = alg_test_null, 4283 .fips_allowed = 1, 4284 }, { 4285 .alg = "authenc(hmac(sha384),rfc3686(ctr(aes)))", 4286 .test = alg_test_null, 4287 .fips_allowed = 1, 4288 }, { 4289 .alg = "authenc(hmac(sha512),cbc(aes))", 4290 .fips_allowed = 1, 4291 .test = alg_test_aead, 4292 .suite = { 4293 .aead = __VECS(hmac_sha512_aes_cbc_tv_temp) 4294 } 4295 }, { 4296 .alg = "authenc(hmac(sha512),cbc(des))", 4297 .test = alg_test_aead, 4298 .suite = { 4299 .aead = __VECS(hmac_sha512_des_cbc_tv_temp) 4300 } 4301 }, { 4302 .alg = "authenc(hmac(sha512),cbc(des3_ede))", 4303 .test = alg_test_aead, 4304 .fips_allowed = 1, 4305 .suite = { 4306 .aead = __VECS(hmac_sha512_des3_ede_cbc_tv_temp) 4307 } 4308 }, { 4309 .alg = "authenc(hmac(sha512),ctr(aes))", 4310 .test = alg_test_null, 4311 .fips_allowed = 1, 4312 }, { 4313 .alg = "authenc(hmac(sha512),rfc3686(ctr(aes)))", 4314 .test = alg_test_null, 4315 .fips_allowed = 1, 4316 }, { 4317 .alg = "blake2b-160", 4318 .test = alg_test_hash, 4319 .fips_allowed = 0, 4320 .suite = { 4321 .hash = __VECS(blake2b_160_tv_template) 4322 } 4323 }, { 4324 .alg = "blake2b-256", 4325 .test = alg_test_hash, 4326 .fips_allowed = 0, 4327 .suite = { 4328 .hash = __VECS(blake2b_256_tv_template) 4329 } 4330 }, { 4331 .alg = "blake2b-384", 4332 .test = alg_test_hash, 4333 .fips_allowed = 0, 4334 .suite = { 4335 .hash = __VECS(blake2b_384_tv_template) 4336 } 4337 }, { 4338 .alg = "blake2b-512", 4339 .test = alg_test_hash, 4340 .fips_allowed = 0, 4341 .suite = { 4342 .hash = __VECS(blake2b_512_tv_template) 4343 } 4344 }, { 4345 .alg = "blake2s-128", 4346 .test = alg_test_hash, 4347 .suite = { 4348 .hash = __VECS(blakes2s_128_tv_template) 4349 } 4350 }, { 4351 .alg = "blake2s-160", 4352 .test = alg_test_hash, 4353 .suite = { 4354 .hash = __VECS(blakes2s_160_tv_template) 4355 } 4356 }, { 4357 .alg = "blake2s-224", 4358 .test = alg_test_hash, 4359 .suite = { 4360 .hash = __VECS(blakes2s_224_tv_template) 4361 } 4362 }, { 4363 .alg = "blake2s-256", 4364 .test = alg_test_hash, 4365 .suite = { 4366 .hash = __VECS(blakes2s_256_tv_template) 4367 } 4368 }, { 4369 .alg = "cbc(aes)", 4370 .test = alg_test_skcipher, 4371 .fips_allowed = 1, 4372 .suite = { 4373 .cipher = __VECS(aes_cbc_tv_template) 4374 }, 4375 }, { 4376 .alg = "cbc(anubis)", 4377 .test = alg_test_skcipher, 4378 .suite = { 4379 .cipher = __VECS(anubis_cbc_tv_template) 4380 }, 4381 }, { 4382 .alg = "cbc(blowfish)", 4383 .test = alg_test_skcipher, 4384 .suite = { 4385 .cipher = __VECS(bf_cbc_tv_template) 4386 }, 4387 }, { 4388 .alg = "cbc(camellia)", 4389 .test = alg_test_skcipher, 4390 .suite = { 4391 .cipher = __VECS(camellia_cbc_tv_template) 4392 }, 4393 }, { 4394 .alg = "cbc(cast5)", 4395 .test = alg_test_skcipher, 4396 .suite = { 4397 .cipher = __VECS(cast5_cbc_tv_template) 4398 }, 4399 }, { 4400 .alg = "cbc(cast6)", 4401 .test = alg_test_skcipher, 4402 .suite = { 4403 .cipher = __VECS(cast6_cbc_tv_template) 4404 }, 4405 }, { 4406 .alg = "cbc(des)", 4407 .test = alg_test_skcipher, 4408 .suite = { 4409 .cipher = __VECS(des_cbc_tv_template) 4410 }, 4411 }, { 4412 .alg = "cbc(des3_ede)", 4413 .test = alg_test_skcipher, 4414 .fips_allowed = 1, 4415 .suite = { 4416 .cipher = __VECS(des3_ede_cbc_tv_template) 4417 }, 4418 }, { 4419 /* Same as cbc(aes) except the key is stored in 4420 * hardware secure memory which we reference by index 4421 */ 4422 .alg = "cbc(paes)", 4423 .test = alg_test_null, 4424 .fips_allowed = 1, 4425 }, { 4426 /* Same as cbc(sm4) except the key is stored in 4427 * hardware secure memory which we reference by index 4428 */ 4429 .alg = "cbc(psm4)", 4430 .test = alg_test_null, 4431 }, { 4432 .alg = "cbc(serpent)", 4433 .test = alg_test_skcipher, 4434 .suite = { 4435 .cipher = __VECS(serpent_cbc_tv_template) 4436 }, 4437 }, { 4438 .alg = "cbc(sm4)", 4439 .test = alg_test_skcipher, 4440 .suite = { 4441 .cipher = __VECS(sm4_cbc_tv_template) 4442 } 4443 }, { 4444 .alg = "cbc(twofish)", 4445 .test = alg_test_skcipher, 4446 .suite = { 4447 .cipher = __VECS(tf_cbc_tv_template) 4448 }, 4449 }, { 4450 #if IS_ENABLED(CONFIG_CRYPTO_PAES_S390) 4451 .alg = "cbc-paes-s390", 4452 .fips_allowed = 1, 4453 .test = alg_test_skcipher, 4454 .suite = { 4455 .cipher = __VECS(aes_cbc_tv_template) 4456 } 4457 }, { 4458 #endif 4459 .alg = "cbcmac(aes)", 4460 .fips_allowed = 1, 4461 .test = alg_test_hash, 4462 .suite = { 4463 .hash = __VECS(aes_cbcmac_tv_template) 4464 } 4465 }, { 4466 .alg = "ccm(aes)", 4467 .generic_driver = "ccm_base(ctr(aes-generic),cbcmac(aes-generic))", 4468 .test = alg_test_aead, 4469 .fips_allowed = 1, 4470 .suite = { 4471 .aead = { 4472 ____VECS(aes_ccm_tv_template), 4473 .einval_allowed = 1, 4474 } 4475 } 4476 }, { 4477 .alg = "cfb(aes)", 4478 .test = alg_test_skcipher, 4479 .fips_allowed = 1, 4480 .suite = { 4481 .cipher = __VECS(aes_cfb_tv_template) 4482 }, 4483 }, { 4484 .alg = "cfb(sm4)", 4485 .test = alg_test_skcipher, 4486 .suite = { 4487 .cipher = __VECS(sm4_cfb_tv_template) 4488 } 4489 }, { 4490 .alg = "chacha20", 4491 .test = alg_test_skcipher, 4492 .suite = { 4493 .cipher = __VECS(chacha20_tv_template) 4494 }, 4495 }, { 4496 .alg = "cmac(aes)", 4497 .fips_allowed = 1, 4498 .test = alg_test_hash, 4499 .suite = { 4500 .hash = __VECS(aes_cmac128_tv_template) 4501 } 4502 }, { 4503 .alg = "cmac(des3_ede)", 4504 .fips_allowed = 1, 4505 .test = alg_test_hash, 4506 .suite = { 4507 .hash = __VECS(des3_ede_cmac64_tv_template) 4508 } 4509 }, { 4510 .alg = "compress_null", 4511 .test = alg_test_null, 4512 }, { 4513 .alg = "crc32", 4514 .test = alg_test_hash, 4515 .fips_allowed = 1, 4516 .suite = { 4517 .hash = __VECS(crc32_tv_template) 4518 } 4519 }, { 4520 .alg = "crc32c", 4521 .test = alg_test_crc32c, 4522 .fips_allowed = 1, 4523 .suite = { 4524 .hash = __VECS(crc32c_tv_template) 4525 } 4526 }, { 4527 .alg = "crct10dif", 4528 .test = alg_test_hash, 4529 .fips_allowed = 1, 4530 .suite = { 4531 .hash = __VECS(crct10dif_tv_template) 4532 } 4533 }, { 4534 .alg = "ctr(aes)", 4535 .test = alg_test_skcipher, 4536 .fips_allowed = 1, 4537 .suite = { 4538 .cipher = __VECS(aes_ctr_tv_template) 4539 } 4540 }, { 4541 .alg = "ctr(blowfish)", 4542 .test = alg_test_skcipher, 4543 .suite = { 4544 .cipher = __VECS(bf_ctr_tv_template) 4545 } 4546 }, { 4547 .alg = "ctr(camellia)", 4548 .test = alg_test_skcipher, 4549 .suite = { 4550 .cipher = __VECS(camellia_ctr_tv_template) 4551 } 4552 }, { 4553 .alg = "ctr(cast5)", 4554 .test = alg_test_skcipher, 4555 .suite = { 4556 .cipher = __VECS(cast5_ctr_tv_template) 4557 } 4558 }, { 4559 .alg = "ctr(cast6)", 4560 .test = alg_test_skcipher, 4561 .suite = { 4562 .cipher = __VECS(cast6_ctr_tv_template) 4563 } 4564 }, { 4565 .alg = "ctr(des)", 4566 .test = alg_test_skcipher, 4567 .suite = { 4568 .cipher = __VECS(des_ctr_tv_template) 4569 } 4570 }, { 4571 .alg = "ctr(des3_ede)", 4572 .test = alg_test_skcipher, 4573 .fips_allowed = 1, 4574 .suite = { 4575 .cipher = __VECS(des3_ede_ctr_tv_template) 4576 } 4577 }, { 4578 /* Same as ctr(aes) except the key is stored in 4579 * hardware secure memory which we reference by index 4580 */ 4581 .alg = "ctr(paes)", 4582 .test = alg_test_null, 4583 .fips_allowed = 1, 4584 }, { 4585 4586 /* Same as ctr(sm4) except the key is stored in 4587 * hardware secure memory which we reference by index 4588 */ 4589 .alg = "ctr(psm4)", 4590 .test = alg_test_null, 4591 }, { 4592 .alg = "ctr(serpent)", 4593 .test = alg_test_skcipher, 4594 .suite = { 4595 .cipher = __VECS(serpent_ctr_tv_template) 4596 } 4597 }, { 4598 .alg = "ctr(sm4)", 4599 .test = alg_test_skcipher, 4600 .suite = { 4601 .cipher = __VECS(sm4_ctr_tv_template) 4602 } 4603 }, { 4604 .alg = "ctr(twofish)", 4605 .test = alg_test_skcipher, 4606 .suite = { 4607 .cipher = __VECS(tf_ctr_tv_template) 4608 } 4609 }, { 4610 #if IS_ENABLED(CONFIG_CRYPTO_PAES_S390) 4611 .alg = "ctr-paes-s390", 4612 .fips_allowed = 1, 4613 .test = alg_test_skcipher, 4614 .suite = { 4615 .cipher = __VECS(aes_ctr_tv_template) 4616 } 4617 }, { 4618 #endif 4619 .alg = "cts(cbc(aes))", 4620 .test = alg_test_skcipher, 4621 .fips_allowed = 1, 4622 .suite = { 4623 .cipher = __VECS(cts_mode_tv_template) 4624 } 4625 }, { 4626 /* Same as cts(cbc((aes)) except the key is stored in 4627 * hardware secure memory which we reference by index 4628 */ 4629 .alg = "cts(cbc(paes))", 4630 .test = alg_test_null, 4631 .fips_allowed = 1, 4632 }, { 4633 .alg = "curve25519", 4634 .test = alg_test_kpp, 4635 .suite = { 4636 .kpp = __VECS(curve25519_tv_template) 4637 } 4638 }, { 4639 .alg = "deflate", 4640 .test = alg_test_comp, 4641 .fips_allowed = 1, 4642 .suite = { 4643 .comp = { 4644 .comp = __VECS(deflate_comp_tv_template), 4645 .decomp = __VECS(deflate_decomp_tv_template) 4646 } 4647 } 4648 }, { 4649 .alg = "dh", 4650 .test = alg_test_kpp, 4651 .fips_allowed = 1, 4652 .suite = { 4653 .kpp = __VECS(dh_tv_template) 4654 } 4655 }, { 4656 .alg = "digest_null", 4657 .test = alg_test_null, 4658 }, { 4659 .alg = "drbg_nopr_ctr_aes128", 4660 .test = alg_test_drbg, 4661 .fips_allowed = 1, 4662 .suite = { 4663 .drbg = __VECS(drbg_nopr_ctr_aes128_tv_template) 4664 } 4665 }, { 4666 .alg = "drbg_nopr_ctr_aes192", 4667 .test = alg_test_drbg, 4668 .fips_allowed = 1, 4669 .suite = { 4670 .drbg = __VECS(drbg_nopr_ctr_aes192_tv_template) 4671 } 4672 }, { 4673 .alg = "drbg_nopr_ctr_aes256", 4674 .test = alg_test_drbg, 4675 .fips_allowed = 1, 4676 .suite = { 4677 .drbg = __VECS(drbg_nopr_ctr_aes256_tv_template) 4678 } 4679 }, { 4680 /* 4681 * There is no need to specifically test the DRBG with every 4682 * backend cipher -- covered by drbg_nopr_hmac_sha256 test 4683 */ 4684 .alg = "drbg_nopr_hmac_sha1", 4685 .fips_allowed = 1, 4686 .test = alg_test_null, 4687 }, { 4688 .alg = "drbg_nopr_hmac_sha256", 4689 .test = alg_test_drbg, 4690 .fips_allowed = 1, 4691 .suite = { 4692 .drbg = __VECS(drbg_nopr_hmac_sha256_tv_template) 4693 } 4694 }, { 4695 /* covered by drbg_nopr_hmac_sha256 test */ 4696 .alg = "drbg_nopr_hmac_sha384", 4697 .fips_allowed = 1, 4698 .test = alg_test_null, 4699 }, { 4700 .alg = "drbg_nopr_hmac_sha512", 4701 .test = alg_test_null, 4702 .fips_allowed = 1, 4703 }, { 4704 .alg = "drbg_nopr_sha1", 4705 .fips_allowed = 1, 4706 .test = alg_test_null, 4707 }, { 4708 .alg = "drbg_nopr_sha256", 4709 .test = alg_test_drbg, 4710 .fips_allowed = 1, 4711 .suite = { 4712 .drbg = __VECS(drbg_nopr_sha256_tv_template) 4713 } 4714 }, { 4715 /* covered by drbg_nopr_sha256 test */ 4716 .alg = "drbg_nopr_sha384", 4717 .fips_allowed = 1, 4718 .test = alg_test_null, 4719 }, { 4720 .alg = "drbg_nopr_sha512", 4721 .fips_allowed = 1, 4722 .test = alg_test_null, 4723 }, { 4724 .alg = "drbg_pr_ctr_aes128", 4725 .test = alg_test_drbg, 4726 .fips_allowed = 1, 4727 .suite = { 4728 .drbg = __VECS(drbg_pr_ctr_aes128_tv_template) 4729 } 4730 }, { 4731 /* covered by drbg_pr_ctr_aes128 test */ 4732 .alg = "drbg_pr_ctr_aes192", 4733 .fips_allowed = 1, 4734 .test = alg_test_null, 4735 }, { 4736 .alg = "drbg_pr_ctr_aes256", 4737 .fips_allowed = 1, 4738 .test = alg_test_null, 4739 }, { 4740 .alg = "drbg_pr_hmac_sha1", 4741 .fips_allowed = 1, 4742 .test = alg_test_null, 4743 }, { 4744 .alg = "drbg_pr_hmac_sha256", 4745 .test = alg_test_drbg, 4746 .fips_allowed = 1, 4747 .suite = { 4748 .drbg = __VECS(drbg_pr_hmac_sha256_tv_template) 4749 } 4750 }, { 4751 /* covered by drbg_pr_hmac_sha256 test */ 4752 .alg = "drbg_pr_hmac_sha384", 4753 .fips_allowed = 1, 4754 .test = alg_test_null, 4755 }, { 4756 .alg = "drbg_pr_hmac_sha512", 4757 .test = alg_test_null, 4758 .fips_allowed = 1, 4759 }, { 4760 .alg = "drbg_pr_sha1", 4761 .fips_allowed = 1, 4762 .test = alg_test_null, 4763 }, { 4764 .alg = "drbg_pr_sha256", 4765 .test = alg_test_drbg, 4766 .fips_allowed = 1, 4767 .suite = { 4768 .drbg = __VECS(drbg_pr_sha256_tv_template) 4769 } 4770 }, { 4771 /* covered by drbg_pr_sha256 test */ 4772 .alg = "drbg_pr_sha384", 4773 .fips_allowed = 1, 4774 .test = alg_test_null, 4775 }, { 4776 .alg = "drbg_pr_sha512", 4777 .fips_allowed = 1, 4778 .test = alg_test_null, 4779 }, { 4780 .alg = "ecb(aes)", 4781 .test = alg_test_skcipher, 4782 .fips_allowed = 1, 4783 .suite = { 4784 .cipher = __VECS(aes_tv_template) 4785 } 4786 }, { 4787 .alg = "ecb(anubis)", 4788 .test = alg_test_skcipher, 4789 .suite = { 4790 .cipher = __VECS(anubis_tv_template) 4791 } 4792 }, { 4793 .alg = "ecb(arc4)", 4794 .generic_driver = "ecb(arc4)-generic", 4795 .test = alg_test_skcipher, 4796 .suite = { 4797 .cipher = __VECS(arc4_tv_template) 4798 } 4799 }, { 4800 .alg = "ecb(blowfish)", 4801 .test = alg_test_skcipher, 4802 .suite = { 4803 .cipher = __VECS(bf_tv_template) 4804 } 4805 }, { 4806 .alg = "ecb(camellia)", 4807 .test = alg_test_skcipher, 4808 .suite = { 4809 .cipher = __VECS(camellia_tv_template) 4810 } 4811 }, { 4812 .alg = "ecb(cast5)", 4813 .test = alg_test_skcipher, 4814 .suite = { 4815 .cipher = __VECS(cast5_tv_template) 4816 } 4817 }, { 4818 .alg = "ecb(cast6)", 4819 .test = alg_test_skcipher, 4820 .suite = { 4821 .cipher = __VECS(cast6_tv_template) 4822 } 4823 }, { 4824 .alg = "ecb(cipher_null)", 4825 .test = alg_test_null, 4826 .fips_allowed = 1, 4827 }, { 4828 .alg = "ecb(des)", 4829 .test = alg_test_skcipher, 4830 .suite = { 4831 .cipher = __VECS(des_tv_template) 4832 } 4833 }, { 4834 .alg = "ecb(des3_ede)", 4835 .test = alg_test_skcipher, 4836 .fips_allowed = 1, 4837 .suite = { 4838 .cipher = __VECS(des3_ede_tv_template) 4839 } 4840 }, { 4841 .alg = "ecb(fcrypt)", 4842 .test = alg_test_skcipher, 4843 .suite = { 4844 .cipher = { 4845 .vecs = fcrypt_pcbc_tv_template, 4846 .count = 1 4847 } 4848 } 4849 }, { 4850 .alg = "ecb(khazad)", 4851 .test = alg_test_skcipher, 4852 .suite = { 4853 .cipher = __VECS(khazad_tv_template) 4854 } 4855 }, { 4856 /* Same as ecb(aes) except the key is stored in 4857 * hardware secure memory which we reference by index 4858 */ 4859 .alg = "ecb(paes)", 4860 .test = alg_test_null, 4861 .fips_allowed = 1, 4862 }, { 4863 .alg = "ecb(seed)", 4864 .test = alg_test_skcipher, 4865 .suite = { 4866 .cipher = __VECS(seed_tv_template) 4867 } 4868 }, { 4869 .alg = "ecb(serpent)", 4870 .test = alg_test_skcipher, 4871 .suite = { 4872 .cipher = __VECS(serpent_tv_template) 4873 } 4874 }, { 4875 .alg = "ecb(sm4)", 4876 .test = alg_test_skcipher, 4877 .suite = { 4878 .cipher = __VECS(sm4_tv_template) 4879 } 4880 }, { 4881 .alg = "ecb(tea)", 4882 .test = alg_test_skcipher, 4883 .suite = { 4884 .cipher = __VECS(tea_tv_template) 4885 } 4886 }, { 4887 .alg = "ecb(tnepres)", 4888 .test = alg_test_skcipher, 4889 .suite = { 4890 .cipher = __VECS(tnepres_tv_template) 4891 } 4892 }, { 4893 .alg = "ecb(twofish)", 4894 .test = alg_test_skcipher, 4895 .suite = { 4896 .cipher = __VECS(tf_tv_template) 4897 } 4898 }, { 4899 .alg = "ecb(xeta)", 4900 .test = alg_test_skcipher, 4901 .suite = { 4902 .cipher = __VECS(xeta_tv_template) 4903 } 4904 }, { 4905 .alg = "ecb(xtea)", 4906 .test = alg_test_skcipher, 4907 .suite = { 4908 .cipher = __VECS(xtea_tv_template) 4909 } 4910 }, { 4911 #if IS_ENABLED(CONFIG_CRYPTO_PAES_S390) 4912 .alg = "ecb-paes-s390", 4913 .fips_allowed = 1, 4914 .test = alg_test_skcipher, 4915 .suite = { 4916 .cipher = __VECS(aes_tv_template) 4917 } 4918 }, { 4919 #endif 4920 .alg = "ecdh", 4921 .test = alg_test_kpp, 4922 .fips_allowed = 1, 4923 .suite = { 4924 .kpp = __VECS(ecdh_tv_template) 4925 } 4926 }, { 4927 .alg = "ecrdsa", 4928 .test = alg_test_akcipher, 4929 .suite = { 4930 .akcipher = __VECS(ecrdsa_tv_template) 4931 } 4932 }, { 4933 .alg = "essiv(authenc(hmac(sha256),cbc(aes)),sha256)", 4934 .test = alg_test_aead, 4935 .fips_allowed = 1, 4936 .suite = { 4937 .aead = __VECS(essiv_hmac_sha256_aes_cbc_tv_temp) 4938 } 4939 }, { 4940 .alg = "essiv(cbc(aes),sha256)", 4941 .test = alg_test_skcipher, 4942 .fips_allowed = 1, 4943 .suite = { 4944 .cipher = __VECS(essiv_aes_cbc_tv_template) 4945 } 4946 }, { 4947 .alg = "gcm(aes)", 4948 .generic_driver = "gcm_base(ctr(aes-generic),ghash-generic)", 4949 .test = alg_test_aead, 4950 .fips_allowed = 1, 4951 .suite = { 4952 .aead = __VECS(aes_gcm_tv_template) 4953 } 4954 }, { 4955 .alg = "ghash", 4956 .test = alg_test_hash, 4957 .fips_allowed = 1, 4958 .suite = { 4959 .hash = __VECS(ghash_tv_template) 4960 } 4961 }, { 4962 .alg = "hmac(md5)", 4963 .test = alg_test_hash, 4964 .suite = { 4965 .hash = __VECS(hmac_md5_tv_template) 4966 } 4967 }, { 4968 .alg = "hmac(rmd128)", 4969 .test = alg_test_hash, 4970 .suite = { 4971 .hash = __VECS(hmac_rmd128_tv_template) 4972 } 4973 }, { 4974 .alg = "hmac(rmd160)", 4975 .test = alg_test_hash, 4976 .suite = { 4977 .hash = __VECS(hmac_rmd160_tv_template) 4978 } 4979 }, { 4980 .alg = "hmac(sha1)", 4981 .test = alg_test_hash, 4982 .fips_allowed = 1, 4983 .suite = { 4984 .hash = __VECS(hmac_sha1_tv_template) 4985 } 4986 }, { 4987 .alg = "hmac(sha224)", 4988 .test = alg_test_hash, 4989 .fips_allowed = 1, 4990 .suite = { 4991 .hash = __VECS(hmac_sha224_tv_template) 4992 } 4993 }, { 4994 .alg = "hmac(sha256)", 4995 .test = alg_test_hash, 4996 .fips_allowed = 1, 4997 .suite = { 4998 .hash = __VECS(hmac_sha256_tv_template) 4999 } 5000 }, { 5001 .alg = "hmac(sha3-224)", 5002 .test = alg_test_hash, 5003 .fips_allowed = 1, 5004 .suite = { 5005 .hash = __VECS(hmac_sha3_224_tv_template) 5006 } 5007 }, { 5008 .alg = "hmac(sha3-256)", 5009 .test = alg_test_hash, 5010 .fips_allowed = 1, 5011 .suite = { 5012 .hash = __VECS(hmac_sha3_256_tv_template) 5013 } 5014 }, { 5015 .alg = "hmac(sha3-384)", 5016 .test = alg_test_hash, 5017 .fips_allowed = 1, 5018 .suite = { 5019 .hash = __VECS(hmac_sha3_384_tv_template) 5020 } 5021 }, { 5022 .alg = "hmac(sha3-512)", 5023 .test = alg_test_hash, 5024 .fips_allowed = 1, 5025 .suite = { 5026 .hash = __VECS(hmac_sha3_512_tv_template) 5027 } 5028 }, { 5029 .alg = "hmac(sha384)", 5030 .test = alg_test_hash, 5031 .fips_allowed = 1, 5032 .suite = { 5033 .hash = __VECS(hmac_sha384_tv_template) 5034 } 5035 }, { 5036 .alg = "hmac(sha512)", 5037 .test = alg_test_hash, 5038 .fips_allowed = 1, 5039 .suite = { 5040 .hash = __VECS(hmac_sha512_tv_template) 5041 } 5042 }, { 5043 .alg = "hmac(sm3)", 5044 .test = alg_test_hash, 5045 .suite = { 5046 .hash = __VECS(hmac_sm3_tv_template) 5047 } 5048 }, { 5049 .alg = "hmac(streebog256)", 5050 .test = alg_test_hash, 5051 .suite = { 5052 .hash = __VECS(hmac_streebog256_tv_template) 5053 } 5054 }, { 5055 .alg = "hmac(streebog512)", 5056 .test = alg_test_hash, 5057 .suite = { 5058 .hash = __VECS(hmac_streebog512_tv_template) 5059 } 5060 }, { 5061 .alg = "jitterentropy_rng", 5062 .fips_allowed = 1, 5063 .test = alg_test_null, 5064 }, { 5065 .alg = "kw(aes)", 5066 .test = alg_test_skcipher, 5067 .fips_allowed = 1, 5068 .suite = { 5069 .cipher = __VECS(aes_kw_tv_template) 5070 } 5071 }, { 5072 .alg = "lrw(aes)", 5073 .generic_driver = "lrw(ecb(aes-generic))", 5074 .test = alg_test_skcipher, 5075 .suite = { 5076 .cipher = __VECS(aes_lrw_tv_template) 5077 } 5078 }, { 5079 .alg = "lrw(camellia)", 5080 .generic_driver = "lrw(ecb(camellia-generic))", 5081 .test = alg_test_skcipher, 5082 .suite = { 5083 .cipher = __VECS(camellia_lrw_tv_template) 5084 } 5085 }, { 5086 .alg = "lrw(cast6)", 5087 .generic_driver = "lrw(ecb(cast6-generic))", 5088 .test = alg_test_skcipher, 5089 .suite = { 5090 .cipher = __VECS(cast6_lrw_tv_template) 5091 } 5092 }, { 5093 .alg = "lrw(serpent)", 5094 .generic_driver = "lrw(ecb(serpent-generic))", 5095 .test = alg_test_skcipher, 5096 .suite = { 5097 .cipher = __VECS(serpent_lrw_tv_template) 5098 } 5099 }, { 5100 .alg = "lrw(twofish)", 5101 .generic_driver = "lrw(ecb(twofish-generic))", 5102 .test = alg_test_skcipher, 5103 .suite = { 5104 .cipher = __VECS(tf_lrw_tv_template) 5105 } 5106 }, { 5107 .alg = "lz4", 5108 .test = alg_test_comp, 5109 .fips_allowed = 1, 5110 .suite = { 5111 .comp = { 5112 .comp = __VECS(lz4_comp_tv_template), 5113 .decomp = __VECS(lz4_decomp_tv_template) 5114 } 5115 } 5116 }, { 5117 .alg = "lz4hc", 5118 .test = alg_test_comp, 5119 .fips_allowed = 1, 5120 .suite = { 5121 .comp = { 5122 .comp = __VECS(lz4hc_comp_tv_template), 5123 .decomp = __VECS(lz4hc_decomp_tv_template) 5124 } 5125 } 5126 }, { 5127 .alg = "lzo", 5128 .test = alg_test_comp, 5129 .fips_allowed = 1, 5130 .suite = { 5131 .comp = { 5132 .comp = __VECS(lzo_comp_tv_template), 5133 .decomp = __VECS(lzo_decomp_tv_template) 5134 } 5135 } 5136 }, { 5137 .alg = "lzo-rle", 5138 .test = alg_test_comp, 5139 .fips_allowed = 1, 5140 .suite = { 5141 .comp = { 5142 .comp = __VECS(lzorle_comp_tv_template), 5143 .decomp = __VECS(lzorle_decomp_tv_template) 5144 } 5145 } 5146 }, { 5147 .alg = "md4", 5148 .test = alg_test_hash, 5149 .suite = { 5150 .hash = __VECS(md4_tv_template) 5151 } 5152 }, { 5153 .alg = "md5", 5154 .test = alg_test_hash, 5155 .suite = { 5156 .hash = __VECS(md5_tv_template) 5157 } 5158 }, { 5159 .alg = "michael_mic", 5160 .test = alg_test_hash, 5161 .suite = { 5162 .hash = __VECS(michael_mic_tv_template) 5163 } 5164 }, { 5165 .alg = "nhpoly1305", 5166 .test = alg_test_hash, 5167 .suite = { 5168 .hash = __VECS(nhpoly1305_tv_template) 5169 } 5170 }, { 5171 .alg = "ofb(aes)", 5172 .test = alg_test_skcipher, 5173 .fips_allowed = 1, 5174 .suite = { 5175 .cipher = __VECS(aes_ofb_tv_template) 5176 } 5177 }, { 5178 /* Same as ofb(aes) except the key is stored in 5179 * hardware secure memory which we reference by index 5180 */ 5181 .alg = "ofb(paes)", 5182 .test = alg_test_null, 5183 .fips_allowed = 1, 5184 }, { 5185 .alg = "ofb(sm4)", 5186 .test = alg_test_skcipher, 5187 .suite = { 5188 .cipher = __VECS(sm4_ofb_tv_template) 5189 } 5190 }, { 5191 .alg = "pcbc(fcrypt)", 5192 .test = alg_test_skcipher, 5193 .suite = { 5194 .cipher = __VECS(fcrypt_pcbc_tv_template) 5195 } 5196 }, { 5197 .alg = "pkcs1pad(rsa,sha224)", 5198 .test = alg_test_null, 5199 .fips_allowed = 1, 5200 }, { 5201 .alg = "pkcs1pad(rsa,sha256)", 5202 .test = alg_test_akcipher, 5203 .fips_allowed = 1, 5204 .suite = { 5205 .akcipher = __VECS(pkcs1pad_rsa_tv_template) 5206 } 5207 }, { 5208 .alg = "pkcs1pad(rsa,sha384)", 5209 .test = alg_test_null, 5210 .fips_allowed = 1, 5211 }, { 5212 .alg = "pkcs1pad(rsa,sha512)", 5213 .test = alg_test_null, 5214 .fips_allowed = 1, 5215 }, { 5216 .alg = "poly1305", 5217 .test = alg_test_hash, 5218 .suite = { 5219 .hash = __VECS(poly1305_tv_template) 5220 } 5221 }, { 5222 .alg = "rfc3686(ctr(aes))", 5223 .test = alg_test_skcipher, 5224 .fips_allowed = 1, 5225 .suite = { 5226 .cipher = __VECS(aes_ctr_rfc3686_tv_template) 5227 } 5228 }, { 5229 .alg = "rfc3686(ctr(sm4))", 5230 .test = alg_test_skcipher, 5231 .suite = { 5232 .cipher = __VECS(sm4_ctr_rfc3686_tv_template) 5233 } 5234 }, { 5235 .alg = "rfc4106(gcm(aes))", 5236 .generic_driver = "rfc4106(gcm_base(ctr(aes-generic),ghash-generic))", 5237 .test = alg_test_aead, 5238 .fips_allowed = 1, 5239 .suite = { 5240 .aead = { 5241 ____VECS(aes_gcm_rfc4106_tv_template), 5242 .einval_allowed = 1, 5243 .aad_iv = 1, 5244 } 5245 } 5246 }, { 5247 .alg = "rfc4309(ccm(aes))", 5248 .generic_driver = "rfc4309(ccm_base(ctr(aes-generic),cbcmac(aes-generic)))", 5249 .test = alg_test_aead, 5250 .fips_allowed = 1, 5251 .suite = { 5252 .aead = { 5253 ____VECS(aes_ccm_rfc4309_tv_template), 5254 .einval_allowed = 1, 5255 .aad_iv = 1, 5256 } 5257 } 5258 }, { 5259 .alg = "rfc4543(gcm(aes))", 5260 .generic_driver = "rfc4543(gcm_base(ctr(aes-generic),ghash-generic))", 5261 .test = alg_test_aead, 5262 .suite = { 5263 .aead = { 5264 ____VECS(aes_gcm_rfc4543_tv_template), 5265 .einval_allowed = 1, 5266 .aad_iv = 1, 5267 } 5268 } 5269 }, { 5270 .alg = "rfc7539(chacha20,poly1305)", 5271 .test = alg_test_aead, 5272 .suite = { 5273 .aead = __VECS(rfc7539_tv_template) 5274 } 5275 }, { 5276 .alg = "rfc7539esp(chacha20,poly1305)", 5277 .test = alg_test_aead, 5278 .suite = { 5279 .aead = { 5280 ____VECS(rfc7539esp_tv_template), 5281 .einval_allowed = 1, 5282 .aad_iv = 1, 5283 } 5284 } 5285 }, { 5286 .alg = "rmd128", 5287 .test = alg_test_hash, 5288 .suite = { 5289 .hash = __VECS(rmd128_tv_template) 5290 } 5291 }, { 5292 .alg = "rmd160", 5293 .test = alg_test_hash, 5294 .suite = { 5295 .hash = __VECS(rmd160_tv_template) 5296 } 5297 }, { 5298 .alg = "rmd256", 5299 .test = alg_test_hash, 5300 .suite = { 5301 .hash = __VECS(rmd256_tv_template) 5302 } 5303 }, { 5304 .alg = "rmd320", 5305 .test = alg_test_hash, 5306 .suite = { 5307 .hash = __VECS(rmd320_tv_template) 5308 } 5309 }, { 5310 .alg = "rsa", 5311 .test = alg_test_akcipher, 5312 .fips_allowed = 1, 5313 .suite = { 5314 .akcipher = __VECS(rsa_tv_template) 5315 } 5316 }, { 5317 .alg = "salsa20", 5318 .test = alg_test_skcipher, 5319 .suite = { 5320 .cipher = __VECS(salsa20_stream_tv_template) 5321 } 5322 }, { 5323 .alg = "sha1", 5324 .test = alg_test_hash, 5325 .fips_allowed = 1, 5326 .suite = { 5327 .hash = __VECS(sha1_tv_template) 5328 } 5329 }, { 5330 .alg = "sha224", 5331 .test = alg_test_hash, 5332 .fips_allowed = 1, 5333 .suite = { 5334 .hash = __VECS(sha224_tv_template) 5335 } 5336 }, { 5337 .alg = "sha256", 5338 .test = alg_test_hash, 5339 .fips_allowed = 1, 5340 .suite = { 5341 .hash = __VECS(sha256_tv_template) 5342 } 5343 }, { 5344 .alg = "sha3-224", 5345 .test = alg_test_hash, 5346 .fips_allowed = 1, 5347 .suite = { 5348 .hash = __VECS(sha3_224_tv_template) 5349 } 5350 }, { 5351 .alg = "sha3-256", 5352 .test = alg_test_hash, 5353 .fips_allowed = 1, 5354 .suite = { 5355 .hash = __VECS(sha3_256_tv_template) 5356 } 5357 }, { 5358 .alg = "sha3-384", 5359 .test = alg_test_hash, 5360 .fips_allowed = 1, 5361 .suite = { 5362 .hash = __VECS(sha3_384_tv_template) 5363 } 5364 }, { 5365 .alg = "sha3-512", 5366 .test = alg_test_hash, 5367 .fips_allowed = 1, 5368 .suite = { 5369 .hash = __VECS(sha3_512_tv_template) 5370 } 5371 }, { 5372 .alg = "sha384", 5373 .test = alg_test_hash, 5374 .fips_allowed = 1, 5375 .suite = { 5376 .hash = __VECS(sha384_tv_template) 5377 } 5378 }, { 5379 .alg = "sha512", 5380 .test = alg_test_hash, 5381 .fips_allowed = 1, 5382 .suite = { 5383 .hash = __VECS(sha512_tv_template) 5384 } 5385 }, { 5386 .alg = "sm2", 5387 .test = alg_test_akcipher, 5388 .suite = { 5389 .akcipher = __VECS(sm2_tv_template) 5390 } 5391 }, { 5392 .alg = "sm3", 5393 .test = alg_test_hash, 5394 .suite = { 5395 .hash = __VECS(sm3_tv_template) 5396 } 5397 }, { 5398 .alg = "streebog256", 5399 .test = alg_test_hash, 5400 .suite = { 5401 .hash = __VECS(streebog256_tv_template) 5402 } 5403 }, { 5404 .alg = "streebog512", 5405 .test = alg_test_hash, 5406 .suite = { 5407 .hash = __VECS(streebog512_tv_template) 5408 } 5409 }, { 5410 .alg = "tgr128", 5411 .test = alg_test_hash, 5412 .suite = { 5413 .hash = __VECS(tgr128_tv_template) 5414 } 5415 }, { 5416 .alg = "tgr160", 5417 .test = alg_test_hash, 5418 .suite = { 5419 .hash = __VECS(tgr160_tv_template) 5420 } 5421 }, { 5422 .alg = "tgr192", 5423 .test = alg_test_hash, 5424 .suite = { 5425 .hash = __VECS(tgr192_tv_template) 5426 } 5427 }, { 5428 .alg = "vmac64(aes)", 5429 .test = alg_test_hash, 5430 .suite = { 5431 .hash = __VECS(vmac64_aes_tv_template) 5432 } 5433 }, { 5434 .alg = "wp256", 5435 .test = alg_test_hash, 5436 .suite = { 5437 .hash = __VECS(wp256_tv_template) 5438 } 5439 }, { 5440 .alg = "wp384", 5441 .test = alg_test_hash, 5442 .suite = { 5443 .hash = __VECS(wp384_tv_template) 5444 } 5445 }, { 5446 .alg = "wp512", 5447 .test = alg_test_hash, 5448 .suite = { 5449 .hash = __VECS(wp512_tv_template) 5450 } 5451 }, { 5452 .alg = "xcbc(aes)", 5453 .test = alg_test_hash, 5454 .suite = { 5455 .hash = __VECS(aes_xcbc128_tv_template) 5456 } 5457 }, { 5458 .alg = "xchacha12", 5459 .test = alg_test_skcipher, 5460 .suite = { 5461 .cipher = __VECS(xchacha12_tv_template) 5462 }, 5463 }, { 5464 .alg = "xchacha20", 5465 .test = alg_test_skcipher, 5466 .suite = { 5467 .cipher = __VECS(xchacha20_tv_template) 5468 }, 5469 }, { 5470 .alg = "xts(aes)", 5471 .generic_driver = "xts(ecb(aes-generic))", 5472 .test = alg_test_skcipher, 5473 .fips_allowed = 1, 5474 .suite = { 5475 .cipher = __VECS(aes_xts_tv_template) 5476 } 5477 }, { 5478 .alg = "xts(camellia)", 5479 .generic_driver = "xts(ecb(camellia-generic))", 5480 .test = alg_test_skcipher, 5481 .suite = { 5482 .cipher = __VECS(camellia_xts_tv_template) 5483 } 5484 }, { 5485 .alg = "xts(cast6)", 5486 .generic_driver = "xts(ecb(cast6-generic))", 5487 .test = alg_test_skcipher, 5488 .suite = { 5489 .cipher = __VECS(cast6_xts_tv_template) 5490 } 5491 }, { 5492 /* Same as xts(aes) except the key is stored in 5493 * hardware secure memory which we reference by index 5494 */ 5495 .alg = "xts(paes)", 5496 .test = alg_test_null, 5497 .fips_allowed = 1, 5498 }, { 5499 .alg = "xts(serpent)", 5500 .generic_driver = "xts(ecb(serpent-generic))", 5501 .test = alg_test_skcipher, 5502 .suite = { 5503 .cipher = __VECS(serpent_xts_tv_template) 5504 } 5505 }, { 5506 .alg = "xts(twofish)", 5507 .generic_driver = "xts(ecb(twofish-generic))", 5508 .test = alg_test_skcipher, 5509 .suite = { 5510 .cipher = __VECS(tf_xts_tv_template) 5511 } 5512 }, { 5513 #if IS_ENABLED(CONFIG_CRYPTO_PAES_S390) 5514 .alg = "xts-paes-s390", 5515 .fips_allowed = 1, 5516 .test = alg_test_skcipher, 5517 .suite = { 5518 .cipher = __VECS(aes_xts_tv_template) 5519 } 5520 }, { 5521 #endif 5522 .alg = "xts4096(paes)", 5523 .test = alg_test_null, 5524 .fips_allowed = 1, 5525 }, { 5526 .alg = "xts512(paes)", 5527 .test = alg_test_null, 5528 .fips_allowed = 1, 5529 }, { 5530 .alg = "xxhash64", 5531 .test = alg_test_hash, 5532 .fips_allowed = 1, 5533 .suite = { 5534 .hash = __VECS(xxhash64_tv_template) 5535 } 5536 }, { 5537 .alg = "zlib-deflate", 5538 .test = alg_test_comp, 5539 .fips_allowed = 1, 5540 .suite = { 5541 .comp = { 5542 .comp = __VECS(zlib_deflate_comp_tv_template), 5543 .decomp = __VECS(zlib_deflate_decomp_tv_template) 5544 } 5545 } 5546 }, { 5547 .alg = "zstd", 5548 .test = alg_test_comp, 5549 .fips_allowed = 1, 5550 .suite = { 5551 .comp = { 5552 .comp = __VECS(zstd_comp_tv_template), 5553 .decomp = __VECS(zstd_decomp_tv_template) 5554 } 5555 } 5556 } 5557 }; 5558 5559 static void alg_check_test_descs_order(void) 5560 { 5561 int i; 5562 5563 for (i = 1; i < ARRAY_SIZE(alg_test_descs); i++) { 5564 int diff = strcmp(alg_test_descs[i - 1].alg, 5565 alg_test_descs[i].alg); 5566 5567 if (WARN_ON(diff > 0)) { 5568 pr_warn("testmgr: alg_test_descs entries in wrong order: '%s' before '%s'\n", 5569 alg_test_descs[i - 1].alg, 5570 alg_test_descs[i].alg); 5571 } 5572 5573 if (WARN_ON(diff == 0)) { 5574 pr_warn("testmgr: duplicate alg_test_descs entry: '%s'\n", 5575 alg_test_descs[i].alg); 5576 } 5577 } 5578 } 5579 5580 static void alg_check_testvec_configs(void) 5581 { 5582 int i; 5583 5584 for (i = 0; i < ARRAY_SIZE(default_cipher_testvec_configs); i++) 5585 WARN_ON(!valid_testvec_config( 5586 &default_cipher_testvec_configs[i])); 5587 5588 for (i = 0; i < ARRAY_SIZE(default_hash_testvec_configs); i++) 5589 WARN_ON(!valid_testvec_config( 5590 &default_hash_testvec_configs[i])); 5591 } 5592 5593 static void testmgr_onetime_init(void) 5594 { 5595 alg_check_test_descs_order(); 5596 alg_check_testvec_configs(); 5597 5598 #ifdef CONFIG_CRYPTO_MANAGER_EXTRA_TESTS 5599 pr_warn("alg: extra crypto tests enabled. This is intended for developer use only.\n"); 5600 #endif 5601 } 5602 5603 static int alg_find_test(const char *alg) 5604 { 5605 int start = 0; 5606 int end = ARRAY_SIZE(alg_test_descs); 5607 5608 while (start < end) { 5609 int i = (start + end) / 2; 5610 int diff = strcmp(alg_test_descs[i].alg, alg); 5611 5612 if (diff > 0) { 5613 end = i; 5614 continue; 5615 } 5616 5617 if (diff < 0) { 5618 start = i + 1; 5619 continue; 5620 } 5621 5622 return i; 5623 } 5624 5625 return -1; 5626 } 5627 5628 int alg_test(const char *driver, const char *alg, u32 type, u32 mask) 5629 { 5630 int i; 5631 int j; 5632 int rc; 5633 5634 if (!fips_enabled && notests) { 5635 printk_once(KERN_INFO "alg: self-tests disabled\n"); 5636 return 0; 5637 } 5638 5639 DO_ONCE(testmgr_onetime_init); 5640 5641 if ((type & CRYPTO_ALG_TYPE_MASK) == CRYPTO_ALG_TYPE_CIPHER) { 5642 char nalg[CRYPTO_MAX_ALG_NAME]; 5643 5644 if (snprintf(nalg, sizeof(nalg), "ecb(%s)", alg) >= 5645 sizeof(nalg)) 5646 return -ENAMETOOLONG; 5647 5648 i = alg_find_test(nalg); 5649 if (i < 0) 5650 goto notest; 5651 5652 if (fips_enabled && !alg_test_descs[i].fips_allowed) 5653 goto non_fips_alg; 5654 5655 rc = alg_test_cipher(alg_test_descs + i, driver, type, mask); 5656 goto test_done; 5657 } 5658 5659 i = alg_find_test(alg); 5660 j = alg_find_test(driver); 5661 if (i < 0 && j < 0) 5662 goto notest; 5663 5664 if (fips_enabled && ((i >= 0 && !alg_test_descs[i].fips_allowed) || 5665 (j >= 0 && !alg_test_descs[j].fips_allowed))) 5666 goto non_fips_alg; 5667 5668 rc = 0; 5669 if (i >= 0) 5670 rc |= alg_test_descs[i].test(alg_test_descs + i, driver, 5671 type, mask); 5672 if (j >= 0 && j != i) 5673 rc |= alg_test_descs[j].test(alg_test_descs + j, driver, 5674 type, mask); 5675 5676 test_done: 5677 if (rc && (fips_enabled || panic_on_fail)) { 5678 fips_fail_notify(); 5679 panic("alg: self-tests for %s (%s) failed in %s mode!\n", 5680 driver, alg, fips_enabled ? "fips" : "panic_on_fail"); 5681 } 5682 5683 if (fips_enabled && !rc) 5684 pr_info("alg: self-tests for %s (%s) passed\n", driver, alg); 5685 5686 return rc; 5687 5688 notest: 5689 printk(KERN_INFO "alg: No test for %s (%s)\n", alg, driver); 5690 return 0; 5691 non_fips_alg: 5692 return -EINVAL; 5693 } 5694 5695 #endif /* CONFIG_CRYPTO_MANAGER_DISABLE_TESTS */ 5696 5697 EXPORT_SYMBOL_GPL(alg_test); 5698