1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * Algorithm testing framework and tests. 4 * 5 * Copyright (c) 2002 James Morris <jmorris@intercode.com.au> 6 * Copyright (c) 2002 Jean-Francois Dive <jef@linuxbe.org> 7 * Copyright (c) 2007 Nokia Siemens Networks 8 * Copyright (c) 2008 Herbert Xu <herbert@gondor.apana.org.au> 9 * Copyright (c) 2019 Google LLC 10 * 11 * Updated RFC4106 AES-GCM testing. 12 * Authors: Aidan O'Mahony (aidan.o.mahony@intel.com) 13 * Adrian Hoban <adrian.hoban@intel.com> 14 * Gabriele Paoloni <gabriele.paoloni@intel.com> 15 * Tadeusz Struk (tadeusz.struk@intel.com) 16 * Copyright (c) 2010, Intel Corporation. 17 */ 18 19 #include <crypto/aead.h> 20 #include <crypto/hash.h> 21 #include <crypto/skcipher.h> 22 #include <linux/err.h> 23 #include <linux/fips.h> 24 #include <linux/module.h> 25 #include <linux/once.h> 26 #include <linux/random.h> 27 #include <linux/scatterlist.h> 28 #include <linux/slab.h> 29 #include <linux/string.h> 30 #include <linux/uio.h> 31 #include <crypto/rng.h> 32 #include <crypto/drbg.h> 33 #include <crypto/akcipher.h> 34 #include <crypto/kpp.h> 35 #include <crypto/acompress.h> 36 #include <crypto/internal/cipher.h> 37 #include <crypto/internal/simd.h> 38 39 #include "internal.h" 40 41 MODULE_IMPORT_NS(CRYPTO_INTERNAL); 42 43 static bool notests; 44 module_param(notests, bool, 0644); 45 MODULE_PARM_DESC(notests, "disable crypto self-tests"); 46 47 static bool panic_on_fail; 48 module_param(panic_on_fail, bool, 0444); 49 50 #ifdef CONFIG_CRYPTO_MANAGER_EXTRA_TESTS 51 static bool noextratests; 52 module_param(noextratests, bool, 0644); 53 MODULE_PARM_DESC(noextratests, "disable expensive crypto self-tests"); 54 55 static unsigned int fuzz_iterations = 100; 56 module_param(fuzz_iterations, uint, 0644); 57 MODULE_PARM_DESC(fuzz_iterations, "number of fuzz test iterations"); 58 #endif 59 60 #ifdef CONFIG_CRYPTO_MANAGER_DISABLE_TESTS 61 62 /* a perfect nop */ 63 int alg_test(const char *driver, const char *alg, u32 type, u32 mask) 64 { 65 return 0; 66 } 67 68 #else 69 70 #include "testmgr.h" 71 72 /* 73 * Need slab memory for testing (size in number of pages). 74 */ 75 #define XBUFSIZE 8 76 77 /* 78 * Used by test_cipher() 79 */ 80 #define ENCRYPT 1 81 #define DECRYPT 0 82 83 struct aead_test_suite { 84 const struct aead_testvec *vecs; 85 unsigned int count; 86 87 /* 88 * Set if trying to decrypt an inauthentic ciphertext with this 89 * algorithm might result in EINVAL rather than EBADMSG, due to other 90 * validation the algorithm does on the inputs such as length checks. 91 */ 92 unsigned int einval_allowed : 1; 93 94 /* 95 * Set if this algorithm requires that the IV be located at the end of 96 * the AAD buffer, in addition to being given in the normal way. The 97 * behavior when the two IV copies differ is implementation-defined. 98 */ 99 unsigned int aad_iv : 1; 100 }; 101 102 struct cipher_test_suite { 103 const struct cipher_testvec *vecs; 104 unsigned int count; 105 }; 106 107 struct comp_test_suite { 108 struct { 109 const struct comp_testvec *vecs; 110 unsigned int count; 111 } comp, decomp; 112 }; 113 114 struct hash_test_suite { 115 const struct hash_testvec *vecs; 116 unsigned int count; 117 }; 118 119 struct cprng_test_suite { 120 const struct cprng_testvec *vecs; 121 unsigned int count; 122 }; 123 124 struct drbg_test_suite { 125 const struct drbg_testvec *vecs; 126 unsigned int count; 127 }; 128 129 struct akcipher_test_suite { 130 const struct akcipher_testvec *vecs; 131 unsigned int count; 132 }; 133 134 struct kpp_test_suite { 135 const struct kpp_testvec *vecs; 136 unsigned int count; 137 }; 138 139 struct alg_test_desc { 140 const char *alg; 141 const char *generic_driver; 142 int (*test)(const struct alg_test_desc *desc, const char *driver, 143 u32 type, u32 mask); 144 int fips_allowed; /* set if alg is allowed in fips mode */ 145 146 union { 147 struct aead_test_suite aead; 148 struct cipher_test_suite cipher; 149 struct comp_test_suite comp; 150 struct hash_test_suite hash; 151 struct cprng_test_suite cprng; 152 struct drbg_test_suite drbg; 153 struct akcipher_test_suite akcipher; 154 struct kpp_test_suite kpp; 155 } suite; 156 }; 157 158 static void hexdump(unsigned char *buf, unsigned int len) 159 { 160 print_hex_dump(KERN_CONT, "", DUMP_PREFIX_OFFSET, 161 16, 1, 162 buf, len, false); 163 } 164 165 static int __testmgr_alloc_buf(char *buf[XBUFSIZE], int order) 166 { 167 int i; 168 169 for (i = 0; i < XBUFSIZE; i++) { 170 buf[i] = (char *)__get_free_pages(GFP_KERNEL, order); 171 if (!buf[i]) 172 goto err_free_buf; 173 } 174 175 return 0; 176 177 err_free_buf: 178 while (i-- > 0) 179 free_pages((unsigned long)buf[i], order); 180 181 return -ENOMEM; 182 } 183 184 static int testmgr_alloc_buf(char *buf[XBUFSIZE]) 185 { 186 return __testmgr_alloc_buf(buf, 0); 187 } 188 189 static void __testmgr_free_buf(char *buf[XBUFSIZE], int order) 190 { 191 int i; 192 193 for (i = 0; i < XBUFSIZE; i++) 194 free_pages((unsigned long)buf[i], order); 195 } 196 197 static void testmgr_free_buf(char *buf[XBUFSIZE]) 198 { 199 __testmgr_free_buf(buf, 0); 200 } 201 202 #define TESTMGR_POISON_BYTE 0xfe 203 #define TESTMGR_POISON_LEN 16 204 205 static inline void testmgr_poison(void *addr, size_t len) 206 { 207 memset(addr, TESTMGR_POISON_BYTE, len); 208 } 209 210 /* Is the memory region still fully poisoned? */ 211 static inline bool testmgr_is_poison(const void *addr, size_t len) 212 { 213 return memchr_inv(addr, TESTMGR_POISON_BYTE, len) == NULL; 214 } 215 216 /* flush type for hash algorithms */ 217 enum flush_type { 218 /* merge with update of previous buffer(s) */ 219 FLUSH_TYPE_NONE = 0, 220 221 /* update with previous buffer(s) before doing this one */ 222 FLUSH_TYPE_FLUSH, 223 224 /* likewise, but also export and re-import the intermediate state */ 225 FLUSH_TYPE_REIMPORT, 226 }; 227 228 /* finalization function for hash algorithms */ 229 enum finalization_type { 230 FINALIZATION_TYPE_FINAL, /* use final() */ 231 FINALIZATION_TYPE_FINUP, /* use finup() */ 232 FINALIZATION_TYPE_DIGEST, /* use digest() */ 233 }; 234 235 #define TEST_SG_TOTAL 10000 236 237 /** 238 * struct test_sg_division - description of a scatterlist entry 239 * 240 * This struct describes one entry of a scatterlist being constructed to check a 241 * crypto test vector. 242 * 243 * @proportion_of_total: length of this chunk relative to the total length, 244 * given as a proportion out of TEST_SG_TOTAL so that it 245 * scales to fit any test vector 246 * @offset: byte offset into a 2-page buffer at which this chunk will start 247 * @offset_relative_to_alignmask: if true, add the algorithm's alignmask to the 248 * @offset 249 * @flush_type: for hashes, whether an update() should be done now vs. 250 * continuing to accumulate data 251 * @nosimd: if doing the pending update(), do it with SIMD disabled? 252 */ 253 struct test_sg_division { 254 unsigned int proportion_of_total; 255 unsigned int offset; 256 bool offset_relative_to_alignmask; 257 enum flush_type flush_type; 258 bool nosimd; 259 }; 260 261 /** 262 * struct testvec_config - configuration for testing a crypto test vector 263 * 264 * This struct describes the data layout and other parameters with which each 265 * crypto test vector can be tested. 266 * 267 * @name: name of this config, logged for debugging purposes if a test fails 268 * @inplace: operate on the data in-place, if applicable for the algorithm type? 269 * @req_flags: extra request_flags, e.g. CRYPTO_TFM_REQ_MAY_SLEEP 270 * @src_divs: description of how to arrange the source scatterlist 271 * @dst_divs: description of how to arrange the dst scatterlist, if applicable 272 * for the algorithm type. Defaults to @src_divs if unset. 273 * @iv_offset: misalignment of the IV in the range [0..MAX_ALGAPI_ALIGNMASK+1], 274 * where 0 is aligned to a 2*(MAX_ALGAPI_ALIGNMASK+1) byte boundary 275 * @iv_offset_relative_to_alignmask: if true, add the algorithm's alignmask to 276 * the @iv_offset 277 * @key_offset: misalignment of the key, where 0 is default alignment 278 * @key_offset_relative_to_alignmask: if true, add the algorithm's alignmask to 279 * the @key_offset 280 * @finalization_type: what finalization function to use for hashes 281 * @nosimd: execute with SIMD disabled? Requires !CRYPTO_TFM_REQ_MAY_SLEEP. 282 */ 283 struct testvec_config { 284 const char *name; 285 bool inplace; 286 u32 req_flags; 287 struct test_sg_division src_divs[XBUFSIZE]; 288 struct test_sg_division dst_divs[XBUFSIZE]; 289 unsigned int iv_offset; 290 unsigned int key_offset; 291 bool iv_offset_relative_to_alignmask; 292 bool key_offset_relative_to_alignmask; 293 enum finalization_type finalization_type; 294 bool nosimd; 295 }; 296 297 #define TESTVEC_CONFIG_NAMELEN 192 298 299 /* 300 * The following are the lists of testvec_configs to test for each algorithm 301 * type when the basic crypto self-tests are enabled, i.e. when 302 * CONFIG_CRYPTO_MANAGER_DISABLE_TESTS is unset. They aim to provide good test 303 * coverage, while keeping the test time much shorter than the full fuzz tests 304 * so that the basic tests can be enabled in a wider range of circumstances. 305 */ 306 307 /* Configs for skciphers and aeads */ 308 static const struct testvec_config default_cipher_testvec_configs[] = { 309 { 310 .name = "in-place", 311 .inplace = true, 312 .src_divs = { { .proportion_of_total = 10000 } }, 313 }, { 314 .name = "out-of-place", 315 .src_divs = { { .proportion_of_total = 10000 } }, 316 }, { 317 .name = "unaligned buffer, offset=1", 318 .src_divs = { { .proportion_of_total = 10000, .offset = 1 } }, 319 .iv_offset = 1, 320 .key_offset = 1, 321 }, { 322 .name = "buffer aligned only to alignmask", 323 .src_divs = { 324 { 325 .proportion_of_total = 10000, 326 .offset = 1, 327 .offset_relative_to_alignmask = true, 328 }, 329 }, 330 .iv_offset = 1, 331 .iv_offset_relative_to_alignmask = true, 332 .key_offset = 1, 333 .key_offset_relative_to_alignmask = true, 334 }, { 335 .name = "two even aligned splits", 336 .src_divs = { 337 { .proportion_of_total = 5000 }, 338 { .proportion_of_total = 5000 }, 339 }, 340 }, { 341 .name = "uneven misaligned splits, may sleep", 342 .req_flags = CRYPTO_TFM_REQ_MAY_SLEEP, 343 .src_divs = { 344 { .proportion_of_total = 1900, .offset = 33 }, 345 { .proportion_of_total = 3300, .offset = 7 }, 346 { .proportion_of_total = 4800, .offset = 18 }, 347 }, 348 .iv_offset = 3, 349 .key_offset = 3, 350 }, { 351 .name = "misaligned splits crossing pages, inplace", 352 .inplace = true, 353 .src_divs = { 354 { 355 .proportion_of_total = 7500, 356 .offset = PAGE_SIZE - 32 357 }, { 358 .proportion_of_total = 2500, 359 .offset = PAGE_SIZE - 7 360 }, 361 }, 362 } 363 }; 364 365 static const struct testvec_config default_hash_testvec_configs[] = { 366 { 367 .name = "init+update+final aligned buffer", 368 .src_divs = { { .proportion_of_total = 10000 } }, 369 .finalization_type = FINALIZATION_TYPE_FINAL, 370 }, { 371 .name = "init+finup aligned buffer", 372 .src_divs = { { .proportion_of_total = 10000 } }, 373 .finalization_type = FINALIZATION_TYPE_FINUP, 374 }, { 375 .name = "digest aligned buffer", 376 .src_divs = { { .proportion_of_total = 10000 } }, 377 .finalization_type = FINALIZATION_TYPE_DIGEST, 378 }, { 379 .name = "init+update+final misaligned buffer", 380 .src_divs = { { .proportion_of_total = 10000, .offset = 1 } }, 381 .finalization_type = FINALIZATION_TYPE_FINAL, 382 .key_offset = 1, 383 }, { 384 .name = "digest buffer aligned only to alignmask", 385 .src_divs = { 386 { 387 .proportion_of_total = 10000, 388 .offset = 1, 389 .offset_relative_to_alignmask = true, 390 }, 391 }, 392 .finalization_type = FINALIZATION_TYPE_DIGEST, 393 .key_offset = 1, 394 .key_offset_relative_to_alignmask = true, 395 }, { 396 .name = "init+update+update+final two even splits", 397 .src_divs = { 398 { .proportion_of_total = 5000 }, 399 { 400 .proportion_of_total = 5000, 401 .flush_type = FLUSH_TYPE_FLUSH, 402 }, 403 }, 404 .finalization_type = FINALIZATION_TYPE_FINAL, 405 }, { 406 .name = "digest uneven misaligned splits, may sleep", 407 .req_flags = CRYPTO_TFM_REQ_MAY_SLEEP, 408 .src_divs = { 409 { .proportion_of_total = 1900, .offset = 33 }, 410 { .proportion_of_total = 3300, .offset = 7 }, 411 { .proportion_of_total = 4800, .offset = 18 }, 412 }, 413 .finalization_type = FINALIZATION_TYPE_DIGEST, 414 }, { 415 .name = "digest misaligned splits crossing pages", 416 .src_divs = { 417 { 418 .proportion_of_total = 7500, 419 .offset = PAGE_SIZE - 32, 420 }, { 421 .proportion_of_total = 2500, 422 .offset = PAGE_SIZE - 7, 423 }, 424 }, 425 .finalization_type = FINALIZATION_TYPE_DIGEST, 426 }, { 427 .name = "import/export", 428 .src_divs = { 429 { 430 .proportion_of_total = 6500, 431 .flush_type = FLUSH_TYPE_REIMPORT, 432 }, { 433 .proportion_of_total = 3500, 434 .flush_type = FLUSH_TYPE_REIMPORT, 435 }, 436 }, 437 .finalization_type = FINALIZATION_TYPE_FINAL, 438 } 439 }; 440 441 static unsigned int count_test_sg_divisions(const struct test_sg_division *divs) 442 { 443 unsigned int remaining = TEST_SG_TOTAL; 444 unsigned int ndivs = 0; 445 446 do { 447 remaining -= divs[ndivs++].proportion_of_total; 448 } while (remaining); 449 450 return ndivs; 451 } 452 453 #define SGDIVS_HAVE_FLUSHES BIT(0) 454 #define SGDIVS_HAVE_NOSIMD BIT(1) 455 456 static bool valid_sg_divisions(const struct test_sg_division *divs, 457 unsigned int count, int *flags_ret) 458 { 459 unsigned int total = 0; 460 unsigned int i; 461 462 for (i = 0; i < count && total != TEST_SG_TOTAL; i++) { 463 if (divs[i].proportion_of_total <= 0 || 464 divs[i].proportion_of_total > TEST_SG_TOTAL - total) 465 return false; 466 total += divs[i].proportion_of_total; 467 if (divs[i].flush_type != FLUSH_TYPE_NONE) 468 *flags_ret |= SGDIVS_HAVE_FLUSHES; 469 if (divs[i].nosimd) 470 *flags_ret |= SGDIVS_HAVE_NOSIMD; 471 } 472 return total == TEST_SG_TOTAL && 473 memchr_inv(&divs[i], 0, (count - i) * sizeof(divs[0])) == NULL; 474 } 475 476 /* 477 * Check whether the given testvec_config is valid. This isn't strictly needed 478 * since every testvec_config should be valid, but check anyway so that people 479 * don't unknowingly add broken configs that don't do what they wanted. 480 */ 481 static bool valid_testvec_config(const struct testvec_config *cfg) 482 { 483 int flags = 0; 484 485 if (cfg->name == NULL) 486 return false; 487 488 if (!valid_sg_divisions(cfg->src_divs, ARRAY_SIZE(cfg->src_divs), 489 &flags)) 490 return false; 491 492 if (cfg->dst_divs[0].proportion_of_total) { 493 if (!valid_sg_divisions(cfg->dst_divs, 494 ARRAY_SIZE(cfg->dst_divs), &flags)) 495 return false; 496 } else { 497 if (memchr_inv(cfg->dst_divs, 0, sizeof(cfg->dst_divs))) 498 return false; 499 /* defaults to dst_divs=src_divs */ 500 } 501 502 if (cfg->iv_offset + 503 (cfg->iv_offset_relative_to_alignmask ? MAX_ALGAPI_ALIGNMASK : 0) > 504 MAX_ALGAPI_ALIGNMASK + 1) 505 return false; 506 507 if ((flags & (SGDIVS_HAVE_FLUSHES | SGDIVS_HAVE_NOSIMD)) && 508 cfg->finalization_type == FINALIZATION_TYPE_DIGEST) 509 return false; 510 511 if ((cfg->nosimd || (flags & SGDIVS_HAVE_NOSIMD)) && 512 (cfg->req_flags & CRYPTO_TFM_REQ_MAY_SLEEP)) 513 return false; 514 515 return true; 516 } 517 518 struct test_sglist { 519 char *bufs[XBUFSIZE]; 520 struct scatterlist sgl[XBUFSIZE]; 521 struct scatterlist sgl_saved[XBUFSIZE]; 522 struct scatterlist *sgl_ptr; 523 unsigned int nents; 524 }; 525 526 static int init_test_sglist(struct test_sglist *tsgl) 527 { 528 return __testmgr_alloc_buf(tsgl->bufs, 1 /* two pages per buffer */); 529 } 530 531 static void destroy_test_sglist(struct test_sglist *tsgl) 532 { 533 return __testmgr_free_buf(tsgl->bufs, 1 /* two pages per buffer */); 534 } 535 536 /** 537 * build_test_sglist() - build a scatterlist for a crypto test 538 * 539 * @tsgl: the scatterlist to build. @tsgl->bufs[] contains an array of 2-page 540 * buffers which the scatterlist @tsgl->sgl[] will be made to point into. 541 * @divs: the layout specification on which the scatterlist will be based 542 * @alignmask: the algorithm's alignmask 543 * @total_len: the total length of the scatterlist to build in bytes 544 * @data: if non-NULL, the buffers will be filled with this data until it ends. 545 * Otherwise the buffers will be poisoned. In both cases, some bytes 546 * past the end of each buffer will be poisoned to help detect overruns. 547 * @out_divs: if non-NULL, the test_sg_division to which each scatterlist entry 548 * corresponds will be returned here. This will match @divs except 549 * that divisions resolving to a length of 0 are omitted as they are 550 * not included in the scatterlist. 551 * 552 * Return: 0 or a -errno value 553 */ 554 static int build_test_sglist(struct test_sglist *tsgl, 555 const struct test_sg_division *divs, 556 const unsigned int alignmask, 557 const unsigned int total_len, 558 struct iov_iter *data, 559 const struct test_sg_division *out_divs[XBUFSIZE]) 560 { 561 struct { 562 const struct test_sg_division *div; 563 size_t length; 564 } partitions[XBUFSIZE]; 565 const unsigned int ndivs = count_test_sg_divisions(divs); 566 unsigned int len_remaining = total_len; 567 unsigned int i; 568 569 BUILD_BUG_ON(ARRAY_SIZE(partitions) != ARRAY_SIZE(tsgl->sgl)); 570 if (WARN_ON(ndivs > ARRAY_SIZE(partitions))) 571 return -EINVAL; 572 573 /* Calculate the (div, length) pairs */ 574 tsgl->nents = 0; 575 for (i = 0; i < ndivs; i++) { 576 unsigned int len_this_sg = 577 min(len_remaining, 578 (total_len * divs[i].proportion_of_total + 579 TEST_SG_TOTAL / 2) / TEST_SG_TOTAL); 580 581 if (len_this_sg != 0) { 582 partitions[tsgl->nents].div = &divs[i]; 583 partitions[tsgl->nents].length = len_this_sg; 584 tsgl->nents++; 585 len_remaining -= len_this_sg; 586 } 587 } 588 if (tsgl->nents == 0) { 589 partitions[tsgl->nents].div = &divs[0]; 590 partitions[tsgl->nents].length = 0; 591 tsgl->nents++; 592 } 593 partitions[tsgl->nents - 1].length += len_remaining; 594 595 /* Set up the sgl entries and fill the data or poison */ 596 sg_init_table(tsgl->sgl, tsgl->nents); 597 for (i = 0; i < tsgl->nents; i++) { 598 unsigned int offset = partitions[i].div->offset; 599 void *addr; 600 601 if (partitions[i].div->offset_relative_to_alignmask) 602 offset += alignmask; 603 604 while (offset + partitions[i].length + TESTMGR_POISON_LEN > 605 2 * PAGE_SIZE) { 606 if (WARN_ON(offset <= 0)) 607 return -EINVAL; 608 offset /= 2; 609 } 610 611 addr = &tsgl->bufs[i][offset]; 612 sg_set_buf(&tsgl->sgl[i], addr, partitions[i].length); 613 614 if (out_divs) 615 out_divs[i] = partitions[i].div; 616 617 if (data) { 618 size_t copy_len, copied; 619 620 copy_len = min(partitions[i].length, data->count); 621 copied = copy_from_iter(addr, copy_len, data); 622 if (WARN_ON(copied != copy_len)) 623 return -EINVAL; 624 testmgr_poison(addr + copy_len, partitions[i].length + 625 TESTMGR_POISON_LEN - copy_len); 626 } else { 627 testmgr_poison(addr, partitions[i].length + 628 TESTMGR_POISON_LEN); 629 } 630 } 631 632 sg_mark_end(&tsgl->sgl[tsgl->nents - 1]); 633 tsgl->sgl_ptr = tsgl->sgl; 634 memcpy(tsgl->sgl_saved, tsgl->sgl, tsgl->nents * sizeof(tsgl->sgl[0])); 635 return 0; 636 } 637 638 /* 639 * Verify that a scatterlist crypto operation produced the correct output. 640 * 641 * @tsgl: scatterlist containing the actual output 642 * @expected_output: buffer containing the expected output 643 * @len_to_check: length of @expected_output in bytes 644 * @unchecked_prefix_len: number of ignored bytes in @tsgl prior to real result 645 * @check_poison: verify that the poison bytes after each chunk are intact? 646 * 647 * Return: 0 if correct, -EINVAL if incorrect, -EOVERFLOW if buffer overrun. 648 */ 649 static int verify_correct_output(const struct test_sglist *tsgl, 650 const char *expected_output, 651 unsigned int len_to_check, 652 unsigned int unchecked_prefix_len, 653 bool check_poison) 654 { 655 unsigned int i; 656 657 for (i = 0; i < tsgl->nents; i++) { 658 struct scatterlist *sg = &tsgl->sgl_ptr[i]; 659 unsigned int len = sg->length; 660 unsigned int offset = sg->offset; 661 const char *actual_output; 662 663 if (unchecked_prefix_len) { 664 if (unchecked_prefix_len >= len) { 665 unchecked_prefix_len -= len; 666 continue; 667 } 668 offset += unchecked_prefix_len; 669 len -= unchecked_prefix_len; 670 unchecked_prefix_len = 0; 671 } 672 len = min(len, len_to_check); 673 actual_output = page_address(sg_page(sg)) + offset; 674 if (memcmp(expected_output, actual_output, len) != 0) 675 return -EINVAL; 676 if (check_poison && 677 !testmgr_is_poison(actual_output + len, TESTMGR_POISON_LEN)) 678 return -EOVERFLOW; 679 len_to_check -= len; 680 expected_output += len; 681 } 682 if (WARN_ON(len_to_check != 0)) 683 return -EINVAL; 684 return 0; 685 } 686 687 static bool is_test_sglist_corrupted(const struct test_sglist *tsgl) 688 { 689 unsigned int i; 690 691 for (i = 0; i < tsgl->nents; i++) { 692 if (tsgl->sgl[i].page_link != tsgl->sgl_saved[i].page_link) 693 return true; 694 if (tsgl->sgl[i].offset != tsgl->sgl_saved[i].offset) 695 return true; 696 if (tsgl->sgl[i].length != tsgl->sgl_saved[i].length) 697 return true; 698 } 699 return false; 700 } 701 702 struct cipher_test_sglists { 703 struct test_sglist src; 704 struct test_sglist dst; 705 }; 706 707 static struct cipher_test_sglists *alloc_cipher_test_sglists(void) 708 { 709 struct cipher_test_sglists *tsgls; 710 711 tsgls = kmalloc(sizeof(*tsgls), GFP_KERNEL); 712 if (!tsgls) 713 return NULL; 714 715 if (init_test_sglist(&tsgls->src) != 0) 716 goto fail_kfree; 717 if (init_test_sglist(&tsgls->dst) != 0) 718 goto fail_destroy_src; 719 720 return tsgls; 721 722 fail_destroy_src: 723 destroy_test_sglist(&tsgls->src); 724 fail_kfree: 725 kfree(tsgls); 726 return NULL; 727 } 728 729 static void free_cipher_test_sglists(struct cipher_test_sglists *tsgls) 730 { 731 if (tsgls) { 732 destroy_test_sglist(&tsgls->src); 733 destroy_test_sglist(&tsgls->dst); 734 kfree(tsgls); 735 } 736 } 737 738 /* Build the src and dst scatterlists for an skcipher or AEAD test */ 739 static int build_cipher_test_sglists(struct cipher_test_sglists *tsgls, 740 const struct testvec_config *cfg, 741 unsigned int alignmask, 742 unsigned int src_total_len, 743 unsigned int dst_total_len, 744 const struct kvec *inputs, 745 unsigned int nr_inputs) 746 { 747 struct iov_iter input; 748 int err; 749 750 iov_iter_kvec(&input, WRITE, inputs, nr_inputs, src_total_len); 751 err = build_test_sglist(&tsgls->src, cfg->src_divs, alignmask, 752 cfg->inplace ? 753 max(dst_total_len, src_total_len) : 754 src_total_len, 755 &input, NULL); 756 if (err) 757 return err; 758 759 if (cfg->inplace) { 760 tsgls->dst.sgl_ptr = tsgls->src.sgl; 761 tsgls->dst.nents = tsgls->src.nents; 762 return 0; 763 } 764 return build_test_sglist(&tsgls->dst, 765 cfg->dst_divs[0].proportion_of_total ? 766 cfg->dst_divs : cfg->src_divs, 767 alignmask, dst_total_len, NULL, NULL); 768 } 769 770 /* 771 * Support for testing passing a misaligned key to setkey(): 772 * 773 * If cfg->key_offset is set, copy the key into a new buffer at that offset, 774 * optionally adding alignmask. Else, just use the key directly. 775 */ 776 static int prepare_keybuf(const u8 *key, unsigned int ksize, 777 const struct testvec_config *cfg, 778 unsigned int alignmask, 779 const u8 **keybuf_ret, const u8 **keyptr_ret) 780 { 781 unsigned int key_offset = cfg->key_offset; 782 u8 *keybuf = NULL, *keyptr = (u8 *)key; 783 784 if (key_offset != 0) { 785 if (cfg->key_offset_relative_to_alignmask) 786 key_offset += alignmask; 787 keybuf = kmalloc(key_offset + ksize, GFP_KERNEL); 788 if (!keybuf) 789 return -ENOMEM; 790 keyptr = keybuf + key_offset; 791 memcpy(keyptr, key, ksize); 792 } 793 *keybuf_ret = keybuf; 794 *keyptr_ret = keyptr; 795 return 0; 796 } 797 798 /* Like setkey_f(tfm, key, ksize), but sometimes misalign the key */ 799 #define do_setkey(setkey_f, tfm, key, ksize, cfg, alignmask) \ 800 ({ \ 801 const u8 *keybuf, *keyptr; \ 802 int err; \ 803 \ 804 err = prepare_keybuf((key), (ksize), (cfg), (alignmask), \ 805 &keybuf, &keyptr); \ 806 if (err == 0) { \ 807 err = setkey_f((tfm), keyptr, (ksize)); \ 808 kfree(keybuf); \ 809 } \ 810 err; \ 811 }) 812 813 #ifdef CONFIG_CRYPTO_MANAGER_EXTRA_TESTS 814 815 /* Generate a random length in range [0, max_len], but prefer smaller values */ 816 static unsigned int generate_random_length(unsigned int max_len) 817 { 818 unsigned int len = prandom_u32() % (max_len + 1); 819 820 switch (prandom_u32() % 4) { 821 case 0: 822 return len % 64; 823 case 1: 824 return len % 256; 825 case 2: 826 return len % 1024; 827 default: 828 return len; 829 } 830 } 831 832 /* Flip a random bit in the given nonempty data buffer */ 833 static void flip_random_bit(u8 *buf, size_t size) 834 { 835 size_t bitpos; 836 837 bitpos = prandom_u32() % (size * 8); 838 buf[bitpos / 8] ^= 1 << (bitpos % 8); 839 } 840 841 /* Flip a random byte in the given nonempty data buffer */ 842 static void flip_random_byte(u8 *buf, size_t size) 843 { 844 buf[prandom_u32() % size] ^= 0xff; 845 } 846 847 /* Sometimes make some random changes to the given nonempty data buffer */ 848 static void mutate_buffer(u8 *buf, size_t size) 849 { 850 size_t num_flips; 851 size_t i; 852 853 /* Sometimes flip some bits */ 854 if (prandom_u32() % 4 == 0) { 855 num_flips = min_t(size_t, 1 << (prandom_u32() % 8), size * 8); 856 for (i = 0; i < num_flips; i++) 857 flip_random_bit(buf, size); 858 } 859 860 /* Sometimes flip some bytes */ 861 if (prandom_u32() % 4 == 0) { 862 num_flips = min_t(size_t, 1 << (prandom_u32() % 8), size); 863 for (i = 0; i < num_flips; i++) 864 flip_random_byte(buf, size); 865 } 866 } 867 868 /* Randomly generate 'count' bytes, but sometimes make them "interesting" */ 869 static void generate_random_bytes(u8 *buf, size_t count) 870 { 871 u8 b; 872 u8 increment; 873 size_t i; 874 875 if (count == 0) 876 return; 877 878 switch (prandom_u32() % 8) { /* Choose a generation strategy */ 879 case 0: 880 case 1: 881 /* All the same byte, plus optional mutations */ 882 switch (prandom_u32() % 4) { 883 case 0: 884 b = 0x00; 885 break; 886 case 1: 887 b = 0xff; 888 break; 889 default: 890 b = (u8)prandom_u32(); 891 break; 892 } 893 memset(buf, b, count); 894 mutate_buffer(buf, count); 895 break; 896 case 2: 897 /* Ascending or descending bytes, plus optional mutations */ 898 increment = (u8)prandom_u32(); 899 b = (u8)prandom_u32(); 900 for (i = 0; i < count; i++, b += increment) 901 buf[i] = b; 902 mutate_buffer(buf, count); 903 break; 904 default: 905 /* Fully random bytes */ 906 for (i = 0; i < count; i++) 907 buf[i] = (u8)prandom_u32(); 908 } 909 } 910 911 static char *generate_random_sgl_divisions(struct test_sg_division *divs, 912 size_t max_divs, char *p, char *end, 913 bool gen_flushes, u32 req_flags) 914 { 915 struct test_sg_division *div = divs; 916 unsigned int remaining = TEST_SG_TOTAL; 917 918 do { 919 unsigned int this_len; 920 const char *flushtype_str; 921 922 if (div == &divs[max_divs - 1] || prandom_u32() % 2 == 0) 923 this_len = remaining; 924 else 925 this_len = 1 + (prandom_u32() % remaining); 926 div->proportion_of_total = this_len; 927 928 if (prandom_u32() % 4 == 0) 929 div->offset = (PAGE_SIZE - 128) + (prandom_u32() % 128); 930 else if (prandom_u32() % 2 == 0) 931 div->offset = prandom_u32() % 32; 932 else 933 div->offset = prandom_u32() % PAGE_SIZE; 934 if (prandom_u32() % 8 == 0) 935 div->offset_relative_to_alignmask = true; 936 937 div->flush_type = FLUSH_TYPE_NONE; 938 if (gen_flushes) { 939 switch (prandom_u32() % 4) { 940 case 0: 941 div->flush_type = FLUSH_TYPE_REIMPORT; 942 break; 943 case 1: 944 div->flush_type = FLUSH_TYPE_FLUSH; 945 break; 946 } 947 } 948 949 if (div->flush_type != FLUSH_TYPE_NONE && 950 !(req_flags & CRYPTO_TFM_REQ_MAY_SLEEP) && 951 prandom_u32() % 2 == 0) 952 div->nosimd = true; 953 954 switch (div->flush_type) { 955 case FLUSH_TYPE_FLUSH: 956 if (div->nosimd) 957 flushtype_str = "<flush,nosimd>"; 958 else 959 flushtype_str = "<flush>"; 960 break; 961 case FLUSH_TYPE_REIMPORT: 962 if (div->nosimd) 963 flushtype_str = "<reimport,nosimd>"; 964 else 965 flushtype_str = "<reimport>"; 966 break; 967 default: 968 flushtype_str = ""; 969 break; 970 } 971 972 BUILD_BUG_ON(TEST_SG_TOTAL != 10000); /* for "%u.%u%%" */ 973 p += scnprintf(p, end - p, "%s%u.%u%%@%s+%u%s", flushtype_str, 974 this_len / 100, this_len % 100, 975 div->offset_relative_to_alignmask ? 976 "alignmask" : "", 977 div->offset, this_len == remaining ? "" : ", "); 978 remaining -= this_len; 979 div++; 980 } while (remaining); 981 982 return p; 983 } 984 985 /* Generate a random testvec_config for fuzz testing */ 986 static void generate_random_testvec_config(struct testvec_config *cfg, 987 char *name, size_t max_namelen) 988 { 989 char *p = name; 990 char * const end = name + max_namelen; 991 992 memset(cfg, 0, sizeof(*cfg)); 993 994 cfg->name = name; 995 996 p += scnprintf(p, end - p, "random:"); 997 998 if (prandom_u32() % 2 == 0) { 999 cfg->inplace = true; 1000 p += scnprintf(p, end - p, " inplace"); 1001 } 1002 1003 if (prandom_u32() % 2 == 0) { 1004 cfg->req_flags |= CRYPTO_TFM_REQ_MAY_SLEEP; 1005 p += scnprintf(p, end - p, " may_sleep"); 1006 } 1007 1008 switch (prandom_u32() % 4) { 1009 case 0: 1010 cfg->finalization_type = FINALIZATION_TYPE_FINAL; 1011 p += scnprintf(p, end - p, " use_final"); 1012 break; 1013 case 1: 1014 cfg->finalization_type = FINALIZATION_TYPE_FINUP; 1015 p += scnprintf(p, end - p, " use_finup"); 1016 break; 1017 default: 1018 cfg->finalization_type = FINALIZATION_TYPE_DIGEST; 1019 p += scnprintf(p, end - p, " use_digest"); 1020 break; 1021 } 1022 1023 if (!(cfg->req_flags & CRYPTO_TFM_REQ_MAY_SLEEP) && 1024 prandom_u32() % 2 == 0) { 1025 cfg->nosimd = true; 1026 p += scnprintf(p, end - p, " nosimd"); 1027 } 1028 1029 p += scnprintf(p, end - p, " src_divs=["); 1030 p = generate_random_sgl_divisions(cfg->src_divs, 1031 ARRAY_SIZE(cfg->src_divs), p, end, 1032 (cfg->finalization_type != 1033 FINALIZATION_TYPE_DIGEST), 1034 cfg->req_flags); 1035 p += scnprintf(p, end - p, "]"); 1036 1037 if (!cfg->inplace && prandom_u32() % 2 == 0) { 1038 p += scnprintf(p, end - p, " dst_divs=["); 1039 p = generate_random_sgl_divisions(cfg->dst_divs, 1040 ARRAY_SIZE(cfg->dst_divs), 1041 p, end, false, 1042 cfg->req_flags); 1043 p += scnprintf(p, end - p, "]"); 1044 } 1045 1046 if (prandom_u32() % 2 == 0) { 1047 cfg->iv_offset = 1 + (prandom_u32() % MAX_ALGAPI_ALIGNMASK); 1048 p += scnprintf(p, end - p, " iv_offset=%u", cfg->iv_offset); 1049 } 1050 1051 if (prandom_u32() % 2 == 0) { 1052 cfg->key_offset = 1 + (prandom_u32() % MAX_ALGAPI_ALIGNMASK); 1053 p += scnprintf(p, end - p, " key_offset=%u", cfg->key_offset); 1054 } 1055 1056 WARN_ON_ONCE(!valid_testvec_config(cfg)); 1057 } 1058 1059 static void crypto_disable_simd_for_test(void) 1060 { 1061 migrate_disable(); 1062 __this_cpu_write(crypto_simd_disabled_for_test, true); 1063 } 1064 1065 static void crypto_reenable_simd_for_test(void) 1066 { 1067 __this_cpu_write(crypto_simd_disabled_for_test, false); 1068 migrate_enable(); 1069 } 1070 1071 /* 1072 * Given an algorithm name, build the name of the generic implementation of that 1073 * algorithm, assuming the usual naming convention. Specifically, this appends 1074 * "-generic" to every part of the name that is not a template name. Examples: 1075 * 1076 * aes => aes-generic 1077 * cbc(aes) => cbc(aes-generic) 1078 * cts(cbc(aes)) => cts(cbc(aes-generic)) 1079 * rfc7539(chacha20,poly1305) => rfc7539(chacha20-generic,poly1305-generic) 1080 * 1081 * Return: 0 on success, or -ENAMETOOLONG if the generic name would be too long 1082 */ 1083 static int build_generic_driver_name(const char *algname, 1084 char driver_name[CRYPTO_MAX_ALG_NAME]) 1085 { 1086 const char *in = algname; 1087 char *out = driver_name; 1088 size_t len = strlen(algname); 1089 1090 if (len >= CRYPTO_MAX_ALG_NAME) 1091 goto too_long; 1092 do { 1093 const char *in_saved = in; 1094 1095 while (*in && *in != '(' && *in != ')' && *in != ',') 1096 *out++ = *in++; 1097 if (*in != '(' && in > in_saved) { 1098 len += 8; 1099 if (len >= CRYPTO_MAX_ALG_NAME) 1100 goto too_long; 1101 memcpy(out, "-generic", 8); 1102 out += 8; 1103 } 1104 } while ((*out++ = *in++) != '\0'); 1105 return 0; 1106 1107 too_long: 1108 pr_err("alg: generic driver name for \"%s\" would be too long\n", 1109 algname); 1110 return -ENAMETOOLONG; 1111 } 1112 #else /* !CONFIG_CRYPTO_MANAGER_EXTRA_TESTS */ 1113 static void crypto_disable_simd_for_test(void) 1114 { 1115 } 1116 1117 static void crypto_reenable_simd_for_test(void) 1118 { 1119 } 1120 #endif /* !CONFIG_CRYPTO_MANAGER_EXTRA_TESTS */ 1121 1122 static int build_hash_sglist(struct test_sglist *tsgl, 1123 const struct hash_testvec *vec, 1124 const struct testvec_config *cfg, 1125 unsigned int alignmask, 1126 const struct test_sg_division *divs[XBUFSIZE]) 1127 { 1128 struct kvec kv; 1129 struct iov_iter input; 1130 1131 kv.iov_base = (void *)vec->plaintext; 1132 kv.iov_len = vec->psize; 1133 iov_iter_kvec(&input, WRITE, &kv, 1, vec->psize); 1134 return build_test_sglist(tsgl, cfg->src_divs, alignmask, vec->psize, 1135 &input, divs); 1136 } 1137 1138 static int check_hash_result(const char *type, 1139 const u8 *result, unsigned int digestsize, 1140 const struct hash_testvec *vec, 1141 const char *vec_name, 1142 const char *driver, 1143 const struct testvec_config *cfg) 1144 { 1145 if (memcmp(result, vec->digest, digestsize) != 0) { 1146 pr_err("alg: %s: %s test failed (wrong result) on test vector %s, cfg=\"%s\"\n", 1147 type, driver, vec_name, cfg->name); 1148 return -EINVAL; 1149 } 1150 if (!testmgr_is_poison(&result[digestsize], TESTMGR_POISON_LEN)) { 1151 pr_err("alg: %s: %s overran result buffer on test vector %s, cfg=\"%s\"\n", 1152 type, driver, vec_name, cfg->name); 1153 return -EOVERFLOW; 1154 } 1155 return 0; 1156 } 1157 1158 static inline int check_shash_op(const char *op, int err, 1159 const char *driver, const char *vec_name, 1160 const struct testvec_config *cfg) 1161 { 1162 if (err) 1163 pr_err("alg: shash: %s %s() failed with err %d on test vector %s, cfg=\"%s\"\n", 1164 driver, op, err, vec_name, cfg->name); 1165 return err; 1166 } 1167 1168 /* Test one hash test vector in one configuration, using the shash API */ 1169 static int test_shash_vec_cfg(const struct hash_testvec *vec, 1170 const char *vec_name, 1171 const struct testvec_config *cfg, 1172 struct shash_desc *desc, 1173 struct test_sglist *tsgl, 1174 u8 *hashstate) 1175 { 1176 struct crypto_shash *tfm = desc->tfm; 1177 const unsigned int alignmask = crypto_shash_alignmask(tfm); 1178 const unsigned int digestsize = crypto_shash_digestsize(tfm); 1179 const unsigned int statesize = crypto_shash_statesize(tfm); 1180 const char *driver = crypto_shash_driver_name(tfm); 1181 const struct test_sg_division *divs[XBUFSIZE]; 1182 unsigned int i; 1183 u8 result[HASH_MAX_DIGESTSIZE + TESTMGR_POISON_LEN]; 1184 int err; 1185 1186 /* Set the key, if specified */ 1187 if (vec->ksize) { 1188 err = do_setkey(crypto_shash_setkey, tfm, vec->key, vec->ksize, 1189 cfg, alignmask); 1190 if (err) { 1191 if (err == vec->setkey_error) 1192 return 0; 1193 pr_err("alg: shash: %s setkey failed on test vector %s; expected_error=%d, actual_error=%d, flags=%#x\n", 1194 driver, vec_name, vec->setkey_error, err, 1195 crypto_shash_get_flags(tfm)); 1196 return err; 1197 } 1198 if (vec->setkey_error) { 1199 pr_err("alg: shash: %s setkey unexpectedly succeeded on test vector %s; expected_error=%d\n", 1200 driver, vec_name, vec->setkey_error); 1201 return -EINVAL; 1202 } 1203 } 1204 1205 /* Build the scatterlist for the source data */ 1206 err = build_hash_sglist(tsgl, vec, cfg, alignmask, divs); 1207 if (err) { 1208 pr_err("alg: shash: %s: error preparing scatterlist for test vector %s, cfg=\"%s\"\n", 1209 driver, vec_name, cfg->name); 1210 return err; 1211 } 1212 1213 /* Do the actual hashing */ 1214 1215 testmgr_poison(desc->__ctx, crypto_shash_descsize(tfm)); 1216 testmgr_poison(result, digestsize + TESTMGR_POISON_LEN); 1217 1218 if (cfg->finalization_type == FINALIZATION_TYPE_DIGEST || 1219 vec->digest_error) { 1220 /* Just using digest() */ 1221 if (tsgl->nents != 1) 1222 return 0; 1223 if (cfg->nosimd) 1224 crypto_disable_simd_for_test(); 1225 err = crypto_shash_digest(desc, sg_virt(&tsgl->sgl[0]), 1226 tsgl->sgl[0].length, result); 1227 if (cfg->nosimd) 1228 crypto_reenable_simd_for_test(); 1229 if (err) { 1230 if (err == vec->digest_error) 1231 return 0; 1232 pr_err("alg: shash: %s digest() failed on test vector %s; expected_error=%d, actual_error=%d, cfg=\"%s\"\n", 1233 driver, vec_name, vec->digest_error, err, 1234 cfg->name); 1235 return err; 1236 } 1237 if (vec->digest_error) { 1238 pr_err("alg: shash: %s digest() unexpectedly succeeded on test vector %s; expected_error=%d, cfg=\"%s\"\n", 1239 driver, vec_name, vec->digest_error, cfg->name); 1240 return -EINVAL; 1241 } 1242 goto result_ready; 1243 } 1244 1245 /* Using init(), zero or more update(), then final() or finup() */ 1246 1247 if (cfg->nosimd) 1248 crypto_disable_simd_for_test(); 1249 err = crypto_shash_init(desc); 1250 if (cfg->nosimd) 1251 crypto_reenable_simd_for_test(); 1252 err = check_shash_op("init", err, driver, vec_name, cfg); 1253 if (err) 1254 return err; 1255 1256 for (i = 0; i < tsgl->nents; i++) { 1257 if (i + 1 == tsgl->nents && 1258 cfg->finalization_type == FINALIZATION_TYPE_FINUP) { 1259 if (divs[i]->nosimd) 1260 crypto_disable_simd_for_test(); 1261 err = crypto_shash_finup(desc, sg_virt(&tsgl->sgl[i]), 1262 tsgl->sgl[i].length, result); 1263 if (divs[i]->nosimd) 1264 crypto_reenable_simd_for_test(); 1265 err = check_shash_op("finup", err, driver, vec_name, 1266 cfg); 1267 if (err) 1268 return err; 1269 goto result_ready; 1270 } 1271 if (divs[i]->nosimd) 1272 crypto_disable_simd_for_test(); 1273 err = crypto_shash_update(desc, sg_virt(&tsgl->sgl[i]), 1274 tsgl->sgl[i].length); 1275 if (divs[i]->nosimd) 1276 crypto_reenable_simd_for_test(); 1277 err = check_shash_op("update", err, driver, vec_name, cfg); 1278 if (err) 1279 return err; 1280 if (divs[i]->flush_type == FLUSH_TYPE_REIMPORT) { 1281 /* Test ->export() and ->import() */ 1282 testmgr_poison(hashstate + statesize, 1283 TESTMGR_POISON_LEN); 1284 err = crypto_shash_export(desc, hashstate); 1285 err = check_shash_op("export", err, driver, vec_name, 1286 cfg); 1287 if (err) 1288 return err; 1289 if (!testmgr_is_poison(hashstate + statesize, 1290 TESTMGR_POISON_LEN)) { 1291 pr_err("alg: shash: %s export() overran state buffer on test vector %s, cfg=\"%s\"\n", 1292 driver, vec_name, cfg->name); 1293 return -EOVERFLOW; 1294 } 1295 testmgr_poison(desc->__ctx, crypto_shash_descsize(tfm)); 1296 err = crypto_shash_import(desc, hashstate); 1297 err = check_shash_op("import", err, driver, vec_name, 1298 cfg); 1299 if (err) 1300 return err; 1301 } 1302 } 1303 1304 if (cfg->nosimd) 1305 crypto_disable_simd_for_test(); 1306 err = crypto_shash_final(desc, result); 1307 if (cfg->nosimd) 1308 crypto_reenable_simd_for_test(); 1309 err = check_shash_op("final", err, driver, vec_name, cfg); 1310 if (err) 1311 return err; 1312 result_ready: 1313 return check_hash_result("shash", result, digestsize, vec, vec_name, 1314 driver, cfg); 1315 } 1316 1317 static int do_ahash_op(int (*op)(struct ahash_request *req), 1318 struct ahash_request *req, 1319 struct crypto_wait *wait, bool nosimd) 1320 { 1321 int err; 1322 1323 if (nosimd) 1324 crypto_disable_simd_for_test(); 1325 1326 err = op(req); 1327 1328 if (nosimd) 1329 crypto_reenable_simd_for_test(); 1330 1331 return crypto_wait_req(err, wait); 1332 } 1333 1334 static int check_nonfinal_ahash_op(const char *op, int err, 1335 u8 *result, unsigned int digestsize, 1336 const char *driver, const char *vec_name, 1337 const struct testvec_config *cfg) 1338 { 1339 if (err) { 1340 pr_err("alg: ahash: %s %s() failed with err %d on test vector %s, cfg=\"%s\"\n", 1341 driver, op, err, vec_name, cfg->name); 1342 return err; 1343 } 1344 if (!testmgr_is_poison(result, digestsize)) { 1345 pr_err("alg: ahash: %s %s() used result buffer on test vector %s, cfg=\"%s\"\n", 1346 driver, op, vec_name, cfg->name); 1347 return -EINVAL; 1348 } 1349 return 0; 1350 } 1351 1352 /* Test one hash test vector in one configuration, using the ahash API */ 1353 static int test_ahash_vec_cfg(const struct hash_testvec *vec, 1354 const char *vec_name, 1355 const struct testvec_config *cfg, 1356 struct ahash_request *req, 1357 struct test_sglist *tsgl, 1358 u8 *hashstate) 1359 { 1360 struct crypto_ahash *tfm = crypto_ahash_reqtfm(req); 1361 const unsigned int alignmask = crypto_ahash_alignmask(tfm); 1362 const unsigned int digestsize = crypto_ahash_digestsize(tfm); 1363 const unsigned int statesize = crypto_ahash_statesize(tfm); 1364 const char *driver = crypto_ahash_driver_name(tfm); 1365 const u32 req_flags = CRYPTO_TFM_REQ_MAY_BACKLOG | cfg->req_flags; 1366 const struct test_sg_division *divs[XBUFSIZE]; 1367 DECLARE_CRYPTO_WAIT(wait); 1368 unsigned int i; 1369 struct scatterlist *pending_sgl; 1370 unsigned int pending_len; 1371 u8 result[HASH_MAX_DIGESTSIZE + TESTMGR_POISON_LEN]; 1372 int err; 1373 1374 /* Set the key, if specified */ 1375 if (vec->ksize) { 1376 err = do_setkey(crypto_ahash_setkey, tfm, vec->key, vec->ksize, 1377 cfg, alignmask); 1378 if (err) { 1379 if (err == vec->setkey_error) 1380 return 0; 1381 pr_err("alg: ahash: %s setkey failed on test vector %s; expected_error=%d, actual_error=%d, flags=%#x\n", 1382 driver, vec_name, vec->setkey_error, err, 1383 crypto_ahash_get_flags(tfm)); 1384 return err; 1385 } 1386 if (vec->setkey_error) { 1387 pr_err("alg: ahash: %s setkey unexpectedly succeeded on test vector %s; expected_error=%d\n", 1388 driver, vec_name, vec->setkey_error); 1389 return -EINVAL; 1390 } 1391 } 1392 1393 /* Build the scatterlist for the source data */ 1394 err = build_hash_sglist(tsgl, vec, cfg, alignmask, divs); 1395 if (err) { 1396 pr_err("alg: ahash: %s: error preparing scatterlist for test vector %s, cfg=\"%s\"\n", 1397 driver, vec_name, cfg->name); 1398 return err; 1399 } 1400 1401 /* Do the actual hashing */ 1402 1403 testmgr_poison(req->__ctx, crypto_ahash_reqsize(tfm)); 1404 testmgr_poison(result, digestsize + TESTMGR_POISON_LEN); 1405 1406 if (cfg->finalization_type == FINALIZATION_TYPE_DIGEST || 1407 vec->digest_error) { 1408 /* Just using digest() */ 1409 ahash_request_set_callback(req, req_flags, crypto_req_done, 1410 &wait); 1411 ahash_request_set_crypt(req, tsgl->sgl, result, vec->psize); 1412 err = do_ahash_op(crypto_ahash_digest, req, &wait, cfg->nosimd); 1413 if (err) { 1414 if (err == vec->digest_error) 1415 return 0; 1416 pr_err("alg: ahash: %s digest() failed on test vector %s; expected_error=%d, actual_error=%d, cfg=\"%s\"\n", 1417 driver, vec_name, vec->digest_error, err, 1418 cfg->name); 1419 return err; 1420 } 1421 if (vec->digest_error) { 1422 pr_err("alg: ahash: %s digest() unexpectedly succeeded on test vector %s; expected_error=%d, cfg=\"%s\"\n", 1423 driver, vec_name, vec->digest_error, cfg->name); 1424 return -EINVAL; 1425 } 1426 goto result_ready; 1427 } 1428 1429 /* Using init(), zero or more update(), then final() or finup() */ 1430 1431 ahash_request_set_callback(req, req_flags, crypto_req_done, &wait); 1432 ahash_request_set_crypt(req, NULL, result, 0); 1433 err = do_ahash_op(crypto_ahash_init, req, &wait, cfg->nosimd); 1434 err = check_nonfinal_ahash_op("init", err, result, digestsize, 1435 driver, vec_name, cfg); 1436 if (err) 1437 return err; 1438 1439 pending_sgl = NULL; 1440 pending_len = 0; 1441 for (i = 0; i < tsgl->nents; i++) { 1442 if (divs[i]->flush_type != FLUSH_TYPE_NONE && 1443 pending_sgl != NULL) { 1444 /* update() with the pending data */ 1445 ahash_request_set_callback(req, req_flags, 1446 crypto_req_done, &wait); 1447 ahash_request_set_crypt(req, pending_sgl, result, 1448 pending_len); 1449 err = do_ahash_op(crypto_ahash_update, req, &wait, 1450 divs[i]->nosimd); 1451 err = check_nonfinal_ahash_op("update", err, 1452 result, digestsize, 1453 driver, vec_name, cfg); 1454 if (err) 1455 return err; 1456 pending_sgl = NULL; 1457 pending_len = 0; 1458 } 1459 if (divs[i]->flush_type == FLUSH_TYPE_REIMPORT) { 1460 /* Test ->export() and ->import() */ 1461 testmgr_poison(hashstate + statesize, 1462 TESTMGR_POISON_LEN); 1463 err = crypto_ahash_export(req, hashstate); 1464 err = check_nonfinal_ahash_op("export", err, 1465 result, digestsize, 1466 driver, vec_name, cfg); 1467 if (err) 1468 return err; 1469 if (!testmgr_is_poison(hashstate + statesize, 1470 TESTMGR_POISON_LEN)) { 1471 pr_err("alg: ahash: %s export() overran state buffer on test vector %s, cfg=\"%s\"\n", 1472 driver, vec_name, cfg->name); 1473 return -EOVERFLOW; 1474 } 1475 1476 testmgr_poison(req->__ctx, crypto_ahash_reqsize(tfm)); 1477 err = crypto_ahash_import(req, hashstate); 1478 err = check_nonfinal_ahash_op("import", err, 1479 result, digestsize, 1480 driver, vec_name, cfg); 1481 if (err) 1482 return err; 1483 } 1484 if (pending_sgl == NULL) 1485 pending_sgl = &tsgl->sgl[i]; 1486 pending_len += tsgl->sgl[i].length; 1487 } 1488 1489 ahash_request_set_callback(req, req_flags, crypto_req_done, &wait); 1490 ahash_request_set_crypt(req, pending_sgl, result, pending_len); 1491 if (cfg->finalization_type == FINALIZATION_TYPE_FINAL) { 1492 /* finish with update() and final() */ 1493 err = do_ahash_op(crypto_ahash_update, req, &wait, cfg->nosimd); 1494 err = check_nonfinal_ahash_op("update", err, result, digestsize, 1495 driver, vec_name, cfg); 1496 if (err) 1497 return err; 1498 err = do_ahash_op(crypto_ahash_final, req, &wait, cfg->nosimd); 1499 if (err) { 1500 pr_err("alg: ahash: %s final() failed with err %d on test vector %s, cfg=\"%s\"\n", 1501 driver, err, vec_name, cfg->name); 1502 return err; 1503 } 1504 } else { 1505 /* finish with finup() */ 1506 err = do_ahash_op(crypto_ahash_finup, req, &wait, cfg->nosimd); 1507 if (err) { 1508 pr_err("alg: ahash: %s finup() failed with err %d on test vector %s, cfg=\"%s\"\n", 1509 driver, err, vec_name, cfg->name); 1510 return err; 1511 } 1512 } 1513 1514 result_ready: 1515 return check_hash_result("ahash", result, digestsize, vec, vec_name, 1516 driver, cfg); 1517 } 1518 1519 static int test_hash_vec_cfg(const struct hash_testvec *vec, 1520 const char *vec_name, 1521 const struct testvec_config *cfg, 1522 struct ahash_request *req, 1523 struct shash_desc *desc, 1524 struct test_sglist *tsgl, 1525 u8 *hashstate) 1526 { 1527 int err; 1528 1529 /* 1530 * For algorithms implemented as "shash", most bugs will be detected by 1531 * both the shash and ahash tests. Test the shash API first so that the 1532 * failures involve less indirection, so are easier to debug. 1533 */ 1534 1535 if (desc) { 1536 err = test_shash_vec_cfg(vec, vec_name, cfg, desc, tsgl, 1537 hashstate); 1538 if (err) 1539 return err; 1540 } 1541 1542 return test_ahash_vec_cfg(vec, vec_name, cfg, req, tsgl, hashstate); 1543 } 1544 1545 static int test_hash_vec(const struct hash_testvec *vec, unsigned int vec_num, 1546 struct ahash_request *req, struct shash_desc *desc, 1547 struct test_sglist *tsgl, u8 *hashstate) 1548 { 1549 char vec_name[16]; 1550 unsigned int i; 1551 int err; 1552 1553 sprintf(vec_name, "%u", vec_num); 1554 1555 for (i = 0; i < ARRAY_SIZE(default_hash_testvec_configs); i++) { 1556 err = test_hash_vec_cfg(vec, vec_name, 1557 &default_hash_testvec_configs[i], 1558 req, desc, tsgl, hashstate); 1559 if (err) 1560 return err; 1561 } 1562 1563 #ifdef CONFIG_CRYPTO_MANAGER_EXTRA_TESTS 1564 if (!noextratests) { 1565 struct testvec_config cfg; 1566 char cfgname[TESTVEC_CONFIG_NAMELEN]; 1567 1568 for (i = 0; i < fuzz_iterations; i++) { 1569 generate_random_testvec_config(&cfg, cfgname, 1570 sizeof(cfgname)); 1571 err = test_hash_vec_cfg(vec, vec_name, &cfg, 1572 req, desc, tsgl, hashstate); 1573 if (err) 1574 return err; 1575 cond_resched(); 1576 } 1577 } 1578 #endif 1579 return 0; 1580 } 1581 1582 #ifdef CONFIG_CRYPTO_MANAGER_EXTRA_TESTS 1583 /* 1584 * Generate a hash test vector from the given implementation. 1585 * Assumes the buffers in 'vec' were already allocated. 1586 */ 1587 static void generate_random_hash_testvec(struct shash_desc *desc, 1588 struct hash_testvec *vec, 1589 unsigned int maxkeysize, 1590 unsigned int maxdatasize, 1591 char *name, size_t max_namelen) 1592 { 1593 /* Data */ 1594 vec->psize = generate_random_length(maxdatasize); 1595 generate_random_bytes((u8 *)vec->plaintext, vec->psize); 1596 1597 /* 1598 * Key: length in range [1, maxkeysize], but usually choose maxkeysize. 1599 * If algorithm is unkeyed, then maxkeysize == 0 and set ksize = 0. 1600 */ 1601 vec->setkey_error = 0; 1602 vec->ksize = 0; 1603 if (maxkeysize) { 1604 vec->ksize = maxkeysize; 1605 if (prandom_u32() % 4 == 0) 1606 vec->ksize = 1 + (prandom_u32() % maxkeysize); 1607 generate_random_bytes((u8 *)vec->key, vec->ksize); 1608 1609 vec->setkey_error = crypto_shash_setkey(desc->tfm, vec->key, 1610 vec->ksize); 1611 /* If the key couldn't be set, no need to continue to digest. */ 1612 if (vec->setkey_error) 1613 goto done; 1614 } 1615 1616 /* Digest */ 1617 vec->digest_error = crypto_shash_digest(desc, vec->plaintext, 1618 vec->psize, (u8 *)vec->digest); 1619 done: 1620 snprintf(name, max_namelen, "\"random: psize=%u ksize=%u\"", 1621 vec->psize, vec->ksize); 1622 } 1623 1624 /* 1625 * Test the hash algorithm represented by @req against the corresponding generic 1626 * implementation, if one is available. 1627 */ 1628 static int test_hash_vs_generic_impl(const char *generic_driver, 1629 unsigned int maxkeysize, 1630 struct ahash_request *req, 1631 struct shash_desc *desc, 1632 struct test_sglist *tsgl, 1633 u8 *hashstate) 1634 { 1635 struct crypto_ahash *tfm = crypto_ahash_reqtfm(req); 1636 const unsigned int digestsize = crypto_ahash_digestsize(tfm); 1637 const unsigned int blocksize = crypto_ahash_blocksize(tfm); 1638 const unsigned int maxdatasize = (2 * PAGE_SIZE) - TESTMGR_POISON_LEN; 1639 const char *algname = crypto_hash_alg_common(tfm)->base.cra_name; 1640 const char *driver = crypto_ahash_driver_name(tfm); 1641 char _generic_driver[CRYPTO_MAX_ALG_NAME]; 1642 struct crypto_shash *generic_tfm = NULL; 1643 struct shash_desc *generic_desc = NULL; 1644 unsigned int i; 1645 struct hash_testvec vec = { 0 }; 1646 char vec_name[64]; 1647 struct testvec_config *cfg; 1648 char cfgname[TESTVEC_CONFIG_NAMELEN]; 1649 int err; 1650 1651 if (noextratests) 1652 return 0; 1653 1654 if (!generic_driver) { /* Use default naming convention? */ 1655 err = build_generic_driver_name(algname, _generic_driver); 1656 if (err) 1657 return err; 1658 generic_driver = _generic_driver; 1659 } 1660 1661 if (strcmp(generic_driver, driver) == 0) /* Already the generic impl? */ 1662 return 0; 1663 1664 generic_tfm = crypto_alloc_shash(generic_driver, 0, 0); 1665 if (IS_ERR(generic_tfm)) { 1666 err = PTR_ERR(generic_tfm); 1667 if (err == -ENOENT) { 1668 pr_warn("alg: hash: skipping comparison tests for %s because %s is unavailable\n", 1669 driver, generic_driver); 1670 return 0; 1671 } 1672 pr_err("alg: hash: error allocating %s (generic impl of %s): %d\n", 1673 generic_driver, algname, err); 1674 return err; 1675 } 1676 1677 cfg = kzalloc(sizeof(*cfg), GFP_KERNEL); 1678 if (!cfg) { 1679 err = -ENOMEM; 1680 goto out; 1681 } 1682 1683 generic_desc = kzalloc(sizeof(*desc) + 1684 crypto_shash_descsize(generic_tfm), GFP_KERNEL); 1685 if (!generic_desc) { 1686 err = -ENOMEM; 1687 goto out; 1688 } 1689 generic_desc->tfm = generic_tfm; 1690 1691 /* Check the algorithm properties for consistency. */ 1692 1693 if (digestsize != crypto_shash_digestsize(generic_tfm)) { 1694 pr_err("alg: hash: digestsize for %s (%u) doesn't match generic impl (%u)\n", 1695 driver, digestsize, 1696 crypto_shash_digestsize(generic_tfm)); 1697 err = -EINVAL; 1698 goto out; 1699 } 1700 1701 if (blocksize != crypto_shash_blocksize(generic_tfm)) { 1702 pr_err("alg: hash: blocksize for %s (%u) doesn't match generic impl (%u)\n", 1703 driver, blocksize, crypto_shash_blocksize(generic_tfm)); 1704 err = -EINVAL; 1705 goto out; 1706 } 1707 1708 /* 1709 * Now generate test vectors using the generic implementation, and test 1710 * the other implementation against them. 1711 */ 1712 1713 vec.key = kmalloc(maxkeysize, GFP_KERNEL); 1714 vec.plaintext = kmalloc(maxdatasize, GFP_KERNEL); 1715 vec.digest = kmalloc(digestsize, GFP_KERNEL); 1716 if (!vec.key || !vec.plaintext || !vec.digest) { 1717 err = -ENOMEM; 1718 goto out; 1719 } 1720 1721 for (i = 0; i < fuzz_iterations * 8; i++) { 1722 generate_random_hash_testvec(generic_desc, &vec, 1723 maxkeysize, maxdatasize, 1724 vec_name, sizeof(vec_name)); 1725 generate_random_testvec_config(cfg, cfgname, sizeof(cfgname)); 1726 1727 err = test_hash_vec_cfg(&vec, vec_name, cfg, 1728 req, desc, tsgl, hashstate); 1729 if (err) 1730 goto out; 1731 cond_resched(); 1732 } 1733 err = 0; 1734 out: 1735 kfree(cfg); 1736 kfree(vec.key); 1737 kfree(vec.plaintext); 1738 kfree(vec.digest); 1739 crypto_free_shash(generic_tfm); 1740 kfree_sensitive(generic_desc); 1741 return err; 1742 } 1743 #else /* !CONFIG_CRYPTO_MANAGER_EXTRA_TESTS */ 1744 static int test_hash_vs_generic_impl(const char *generic_driver, 1745 unsigned int maxkeysize, 1746 struct ahash_request *req, 1747 struct shash_desc *desc, 1748 struct test_sglist *tsgl, 1749 u8 *hashstate) 1750 { 1751 return 0; 1752 } 1753 #endif /* !CONFIG_CRYPTO_MANAGER_EXTRA_TESTS */ 1754 1755 static int alloc_shash(const char *driver, u32 type, u32 mask, 1756 struct crypto_shash **tfm_ret, 1757 struct shash_desc **desc_ret) 1758 { 1759 struct crypto_shash *tfm; 1760 struct shash_desc *desc; 1761 1762 tfm = crypto_alloc_shash(driver, type, mask); 1763 if (IS_ERR(tfm)) { 1764 if (PTR_ERR(tfm) == -ENOENT) { 1765 /* 1766 * This algorithm is only available through the ahash 1767 * API, not the shash API, so skip the shash tests. 1768 */ 1769 return 0; 1770 } 1771 pr_err("alg: hash: failed to allocate shash transform for %s: %ld\n", 1772 driver, PTR_ERR(tfm)); 1773 return PTR_ERR(tfm); 1774 } 1775 1776 desc = kmalloc(sizeof(*desc) + crypto_shash_descsize(tfm), GFP_KERNEL); 1777 if (!desc) { 1778 crypto_free_shash(tfm); 1779 return -ENOMEM; 1780 } 1781 desc->tfm = tfm; 1782 1783 *tfm_ret = tfm; 1784 *desc_ret = desc; 1785 return 0; 1786 } 1787 1788 static int __alg_test_hash(const struct hash_testvec *vecs, 1789 unsigned int num_vecs, const char *driver, 1790 u32 type, u32 mask, 1791 const char *generic_driver, unsigned int maxkeysize) 1792 { 1793 struct crypto_ahash *atfm = NULL; 1794 struct ahash_request *req = NULL; 1795 struct crypto_shash *stfm = NULL; 1796 struct shash_desc *desc = NULL; 1797 struct test_sglist *tsgl = NULL; 1798 u8 *hashstate = NULL; 1799 unsigned int statesize; 1800 unsigned int i; 1801 int err; 1802 1803 /* 1804 * Always test the ahash API. This works regardless of whether the 1805 * algorithm is implemented as ahash or shash. 1806 */ 1807 1808 atfm = crypto_alloc_ahash(driver, type, mask); 1809 if (IS_ERR(atfm)) { 1810 pr_err("alg: hash: failed to allocate transform for %s: %ld\n", 1811 driver, PTR_ERR(atfm)); 1812 return PTR_ERR(atfm); 1813 } 1814 driver = crypto_ahash_driver_name(atfm); 1815 1816 req = ahash_request_alloc(atfm, GFP_KERNEL); 1817 if (!req) { 1818 pr_err("alg: hash: failed to allocate request for %s\n", 1819 driver); 1820 err = -ENOMEM; 1821 goto out; 1822 } 1823 1824 /* 1825 * If available also test the shash API, to cover corner cases that may 1826 * be missed by testing the ahash API only. 1827 */ 1828 err = alloc_shash(driver, type, mask, &stfm, &desc); 1829 if (err) 1830 goto out; 1831 1832 tsgl = kmalloc(sizeof(*tsgl), GFP_KERNEL); 1833 if (!tsgl || init_test_sglist(tsgl) != 0) { 1834 pr_err("alg: hash: failed to allocate test buffers for %s\n", 1835 driver); 1836 kfree(tsgl); 1837 tsgl = NULL; 1838 err = -ENOMEM; 1839 goto out; 1840 } 1841 1842 statesize = crypto_ahash_statesize(atfm); 1843 if (stfm) 1844 statesize = max(statesize, crypto_shash_statesize(stfm)); 1845 hashstate = kmalloc(statesize + TESTMGR_POISON_LEN, GFP_KERNEL); 1846 if (!hashstate) { 1847 pr_err("alg: hash: failed to allocate hash state buffer for %s\n", 1848 driver); 1849 err = -ENOMEM; 1850 goto out; 1851 } 1852 1853 for (i = 0; i < num_vecs; i++) { 1854 if (fips_enabled && vecs[i].fips_skip) 1855 continue; 1856 1857 err = test_hash_vec(&vecs[i], i, req, desc, tsgl, hashstate); 1858 if (err) 1859 goto out; 1860 cond_resched(); 1861 } 1862 err = test_hash_vs_generic_impl(generic_driver, maxkeysize, req, 1863 desc, tsgl, hashstate); 1864 out: 1865 kfree(hashstate); 1866 if (tsgl) { 1867 destroy_test_sglist(tsgl); 1868 kfree(tsgl); 1869 } 1870 kfree(desc); 1871 crypto_free_shash(stfm); 1872 ahash_request_free(req); 1873 crypto_free_ahash(atfm); 1874 return err; 1875 } 1876 1877 static int alg_test_hash(const struct alg_test_desc *desc, const char *driver, 1878 u32 type, u32 mask) 1879 { 1880 const struct hash_testvec *template = desc->suite.hash.vecs; 1881 unsigned int tcount = desc->suite.hash.count; 1882 unsigned int nr_unkeyed, nr_keyed; 1883 unsigned int maxkeysize = 0; 1884 int err; 1885 1886 /* 1887 * For OPTIONAL_KEY algorithms, we have to do all the unkeyed tests 1888 * first, before setting a key on the tfm. To make this easier, we 1889 * require that the unkeyed test vectors (if any) are listed first. 1890 */ 1891 1892 for (nr_unkeyed = 0; nr_unkeyed < tcount; nr_unkeyed++) { 1893 if (template[nr_unkeyed].ksize) 1894 break; 1895 } 1896 for (nr_keyed = 0; nr_unkeyed + nr_keyed < tcount; nr_keyed++) { 1897 if (!template[nr_unkeyed + nr_keyed].ksize) { 1898 pr_err("alg: hash: test vectors for %s out of order, " 1899 "unkeyed ones must come first\n", desc->alg); 1900 return -EINVAL; 1901 } 1902 maxkeysize = max_t(unsigned int, maxkeysize, 1903 template[nr_unkeyed + nr_keyed].ksize); 1904 } 1905 1906 err = 0; 1907 if (nr_unkeyed) { 1908 err = __alg_test_hash(template, nr_unkeyed, driver, type, mask, 1909 desc->generic_driver, maxkeysize); 1910 template += nr_unkeyed; 1911 } 1912 1913 if (!err && nr_keyed) 1914 err = __alg_test_hash(template, nr_keyed, driver, type, mask, 1915 desc->generic_driver, maxkeysize); 1916 1917 return err; 1918 } 1919 1920 static int test_aead_vec_cfg(int enc, const struct aead_testvec *vec, 1921 const char *vec_name, 1922 const struct testvec_config *cfg, 1923 struct aead_request *req, 1924 struct cipher_test_sglists *tsgls) 1925 { 1926 struct crypto_aead *tfm = crypto_aead_reqtfm(req); 1927 const unsigned int alignmask = crypto_aead_alignmask(tfm); 1928 const unsigned int ivsize = crypto_aead_ivsize(tfm); 1929 const unsigned int authsize = vec->clen - vec->plen; 1930 const char *driver = crypto_aead_driver_name(tfm); 1931 const u32 req_flags = CRYPTO_TFM_REQ_MAY_BACKLOG | cfg->req_flags; 1932 const char *op = enc ? "encryption" : "decryption"; 1933 DECLARE_CRYPTO_WAIT(wait); 1934 u8 _iv[3 * (MAX_ALGAPI_ALIGNMASK + 1) + MAX_IVLEN]; 1935 u8 *iv = PTR_ALIGN(&_iv[0], 2 * (MAX_ALGAPI_ALIGNMASK + 1)) + 1936 cfg->iv_offset + 1937 (cfg->iv_offset_relative_to_alignmask ? alignmask : 0); 1938 struct kvec input[2]; 1939 int err; 1940 1941 /* Set the key */ 1942 if (vec->wk) 1943 crypto_aead_set_flags(tfm, CRYPTO_TFM_REQ_FORBID_WEAK_KEYS); 1944 else 1945 crypto_aead_clear_flags(tfm, CRYPTO_TFM_REQ_FORBID_WEAK_KEYS); 1946 1947 err = do_setkey(crypto_aead_setkey, tfm, vec->key, vec->klen, 1948 cfg, alignmask); 1949 if (err && err != vec->setkey_error) { 1950 pr_err("alg: aead: %s setkey failed on test vector %s; expected_error=%d, actual_error=%d, flags=%#x\n", 1951 driver, vec_name, vec->setkey_error, err, 1952 crypto_aead_get_flags(tfm)); 1953 return err; 1954 } 1955 if (!err && vec->setkey_error) { 1956 pr_err("alg: aead: %s setkey unexpectedly succeeded on test vector %s; expected_error=%d\n", 1957 driver, vec_name, vec->setkey_error); 1958 return -EINVAL; 1959 } 1960 1961 /* Set the authentication tag size */ 1962 err = crypto_aead_setauthsize(tfm, authsize); 1963 if (err && err != vec->setauthsize_error) { 1964 pr_err("alg: aead: %s setauthsize failed on test vector %s; expected_error=%d, actual_error=%d\n", 1965 driver, vec_name, vec->setauthsize_error, err); 1966 return err; 1967 } 1968 if (!err && vec->setauthsize_error) { 1969 pr_err("alg: aead: %s setauthsize unexpectedly succeeded on test vector %s; expected_error=%d\n", 1970 driver, vec_name, vec->setauthsize_error); 1971 return -EINVAL; 1972 } 1973 1974 if (vec->setkey_error || vec->setauthsize_error) 1975 return 0; 1976 1977 /* The IV must be copied to a buffer, as the algorithm may modify it */ 1978 if (WARN_ON(ivsize > MAX_IVLEN)) 1979 return -EINVAL; 1980 if (vec->iv) 1981 memcpy(iv, vec->iv, ivsize); 1982 else 1983 memset(iv, 0, ivsize); 1984 1985 /* Build the src/dst scatterlists */ 1986 input[0].iov_base = (void *)vec->assoc; 1987 input[0].iov_len = vec->alen; 1988 input[1].iov_base = enc ? (void *)vec->ptext : (void *)vec->ctext; 1989 input[1].iov_len = enc ? vec->plen : vec->clen; 1990 err = build_cipher_test_sglists(tsgls, cfg, alignmask, 1991 vec->alen + (enc ? vec->plen : 1992 vec->clen), 1993 vec->alen + (enc ? vec->clen : 1994 vec->plen), 1995 input, 2); 1996 if (err) { 1997 pr_err("alg: aead: %s %s: error preparing scatterlists for test vector %s, cfg=\"%s\"\n", 1998 driver, op, vec_name, cfg->name); 1999 return err; 2000 } 2001 2002 /* Do the actual encryption or decryption */ 2003 testmgr_poison(req->__ctx, crypto_aead_reqsize(tfm)); 2004 aead_request_set_callback(req, req_flags, crypto_req_done, &wait); 2005 aead_request_set_crypt(req, tsgls->src.sgl_ptr, tsgls->dst.sgl_ptr, 2006 enc ? vec->plen : vec->clen, iv); 2007 aead_request_set_ad(req, vec->alen); 2008 if (cfg->nosimd) 2009 crypto_disable_simd_for_test(); 2010 err = enc ? crypto_aead_encrypt(req) : crypto_aead_decrypt(req); 2011 if (cfg->nosimd) 2012 crypto_reenable_simd_for_test(); 2013 err = crypto_wait_req(err, &wait); 2014 2015 /* Check that the algorithm didn't overwrite things it shouldn't have */ 2016 if (req->cryptlen != (enc ? vec->plen : vec->clen) || 2017 req->assoclen != vec->alen || 2018 req->iv != iv || 2019 req->src != tsgls->src.sgl_ptr || 2020 req->dst != tsgls->dst.sgl_ptr || 2021 crypto_aead_reqtfm(req) != tfm || 2022 req->base.complete != crypto_req_done || 2023 req->base.flags != req_flags || 2024 req->base.data != &wait) { 2025 pr_err("alg: aead: %s %s corrupted request struct on test vector %s, cfg=\"%s\"\n", 2026 driver, op, vec_name, cfg->name); 2027 if (req->cryptlen != (enc ? vec->plen : vec->clen)) 2028 pr_err("alg: aead: changed 'req->cryptlen'\n"); 2029 if (req->assoclen != vec->alen) 2030 pr_err("alg: aead: changed 'req->assoclen'\n"); 2031 if (req->iv != iv) 2032 pr_err("alg: aead: changed 'req->iv'\n"); 2033 if (req->src != tsgls->src.sgl_ptr) 2034 pr_err("alg: aead: changed 'req->src'\n"); 2035 if (req->dst != tsgls->dst.sgl_ptr) 2036 pr_err("alg: aead: changed 'req->dst'\n"); 2037 if (crypto_aead_reqtfm(req) != tfm) 2038 pr_err("alg: aead: changed 'req->base.tfm'\n"); 2039 if (req->base.complete != crypto_req_done) 2040 pr_err("alg: aead: changed 'req->base.complete'\n"); 2041 if (req->base.flags != req_flags) 2042 pr_err("alg: aead: changed 'req->base.flags'\n"); 2043 if (req->base.data != &wait) 2044 pr_err("alg: aead: changed 'req->base.data'\n"); 2045 return -EINVAL; 2046 } 2047 if (is_test_sglist_corrupted(&tsgls->src)) { 2048 pr_err("alg: aead: %s %s corrupted src sgl on test vector %s, cfg=\"%s\"\n", 2049 driver, op, vec_name, cfg->name); 2050 return -EINVAL; 2051 } 2052 if (tsgls->dst.sgl_ptr != tsgls->src.sgl && 2053 is_test_sglist_corrupted(&tsgls->dst)) { 2054 pr_err("alg: aead: %s %s corrupted dst sgl on test vector %s, cfg=\"%s\"\n", 2055 driver, op, vec_name, cfg->name); 2056 return -EINVAL; 2057 } 2058 2059 /* Check for unexpected success or failure, or wrong error code */ 2060 if ((err == 0 && vec->novrfy) || 2061 (err != vec->crypt_error && !(err == -EBADMSG && vec->novrfy))) { 2062 char expected_error[32]; 2063 2064 if (vec->novrfy && 2065 vec->crypt_error != 0 && vec->crypt_error != -EBADMSG) 2066 sprintf(expected_error, "-EBADMSG or %d", 2067 vec->crypt_error); 2068 else if (vec->novrfy) 2069 sprintf(expected_error, "-EBADMSG"); 2070 else 2071 sprintf(expected_error, "%d", vec->crypt_error); 2072 if (err) { 2073 pr_err("alg: aead: %s %s failed on test vector %s; expected_error=%s, actual_error=%d, cfg=\"%s\"\n", 2074 driver, op, vec_name, expected_error, err, 2075 cfg->name); 2076 return err; 2077 } 2078 pr_err("alg: aead: %s %s unexpectedly succeeded on test vector %s; expected_error=%s, cfg=\"%s\"\n", 2079 driver, op, vec_name, expected_error, cfg->name); 2080 return -EINVAL; 2081 } 2082 if (err) /* Expectedly failed. */ 2083 return 0; 2084 2085 /* Check for the correct output (ciphertext or plaintext) */ 2086 err = verify_correct_output(&tsgls->dst, enc ? vec->ctext : vec->ptext, 2087 enc ? vec->clen : vec->plen, 2088 vec->alen, enc || !cfg->inplace); 2089 if (err == -EOVERFLOW) { 2090 pr_err("alg: aead: %s %s overran dst buffer on test vector %s, cfg=\"%s\"\n", 2091 driver, op, vec_name, cfg->name); 2092 return err; 2093 } 2094 if (err) { 2095 pr_err("alg: aead: %s %s test failed (wrong result) on test vector %s, cfg=\"%s\"\n", 2096 driver, op, vec_name, cfg->name); 2097 return err; 2098 } 2099 2100 return 0; 2101 } 2102 2103 static int test_aead_vec(int enc, const struct aead_testvec *vec, 2104 unsigned int vec_num, struct aead_request *req, 2105 struct cipher_test_sglists *tsgls) 2106 { 2107 char vec_name[16]; 2108 unsigned int i; 2109 int err; 2110 2111 if (enc && vec->novrfy) 2112 return 0; 2113 2114 sprintf(vec_name, "%u", vec_num); 2115 2116 for (i = 0; i < ARRAY_SIZE(default_cipher_testvec_configs); i++) { 2117 err = test_aead_vec_cfg(enc, vec, vec_name, 2118 &default_cipher_testvec_configs[i], 2119 req, tsgls); 2120 if (err) 2121 return err; 2122 } 2123 2124 #ifdef CONFIG_CRYPTO_MANAGER_EXTRA_TESTS 2125 if (!noextratests) { 2126 struct testvec_config cfg; 2127 char cfgname[TESTVEC_CONFIG_NAMELEN]; 2128 2129 for (i = 0; i < fuzz_iterations; i++) { 2130 generate_random_testvec_config(&cfg, cfgname, 2131 sizeof(cfgname)); 2132 err = test_aead_vec_cfg(enc, vec, vec_name, 2133 &cfg, req, tsgls); 2134 if (err) 2135 return err; 2136 cond_resched(); 2137 } 2138 } 2139 #endif 2140 return 0; 2141 } 2142 2143 #ifdef CONFIG_CRYPTO_MANAGER_EXTRA_TESTS 2144 2145 struct aead_extra_tests_ctx { 2146 struct aead_request *req; 2147 struct crypto_aead *tfm; 2148 const struct alg_test_desc *test_desc; 2149 struct cipher_test_sglists *tsgls; 2150 unsigned int maxdatasize; 2151 unsigned int maxkeysize; 2152 2153 struct aead_testvec vec; 2154 char vec_name[64]; 2155 char cfgname[TESTVEC_CONFIG_NAMELEN]; 2156 struct testvec_config cfg; 2157 }; 2158 2159 /* 2160 * Make at least one random change to a (ciphertext, AAD) pair. "Ciphertext" 2161 * here means the full ciphertext including the authentication tag. The 2162 * authentication tag (and hence also the ciphertext) is assumed to be nonempty. 2163 */ 2164 static void mutate_aead_message(struct aead_testvec *vec, bool aad_iv, 2165 unsigned int ivsize) 2166 { 2167 const unsigned int aad_tail_size = aad_iv ? ivsize : 0; 2168 const unsigned int authsize = vec->clen - vec->plen; 2169 2170 if (prandom_u32() % 2 == 0 && vec->alen > aad_tail_size) { 2171 /* Mutate the AAD */ 2172 flip_random_bit((u8 *)vec->assoc, vec->alen - aad_tail_size); 2173 if (prandom_u32() % 2 == 0) 2174 return; 2175 } 2176 if (prandom_u32() % 2 == 0) { 2177 /* Mutate auth tag (assuming it's at the end of ciphertext) */ 2178 flip_random_bit((u8 *)vec->ctext + vec->plen, authsize); 2179 } else { 2180 /* Mutate any part of the ciphertext */ 2181 flip_random_bit((u8 *)vec->ctext, vec->clen); 2182 } 2183 } 2184 2185 /* 2186 * Minimum authentication tag size in bytes at which we assume that we can 2187 * reliably generate inauthentic messages, i.e. not generate an authentic 2188 * message by chance. 2189 */ 2190 #define MIN_COLLISION_FREE_AUTHSIZE 8 2191 2192 static void generate_aead_message(struct aead_request *req, 2193 const struct aead_test_suite *suite, 2194 struct aead_testvec *vec, 2195 bool prefer_inauthentic) 2196 { 2197 struct crypto_aead *tfm = crypto_aead_reqtfm(req); 2198 const unsigned int ivsize = crypto_aead_ivsize(tfm); 2199 const unsigned int authsize = vec->clen - vec->plen; 2200 const bool inauthentic = (authsize >= MIN_COLLISION_FREE_AUTHSIZE) && 2201 (prefer_inauthentic || prandom_u32() % 4 == 0); 2202 2203 /* Generate the AAD. */ 2204 generate_random_bytes((u8 *)vec->assoc, vec->alen); 2205 if (suite->aad_iv && vec->alen >= ivsize) 2206 /* Avoid implementation-defined behavior. */ 2207 memcpy((u8 *)vec->assoc + vec->alen - ivsize, vec->iv, ivsize); 2208 2209 if (inauthentic && prandom_u32() % 2 == 0) { 2210 /* Generate a random ciphertext. */ 2211 generate_random_bytes((u8 *)vec->ctext, vec->clen); 2212 } else { 2213 int i = 0; 2214 struct scatterlist src[2], dst; 2215 u8 iv[MAX_IVLEN]; 2216 DECLARE_CRYPTO_WAIT(wait); 2217 2218 /* Generate a random plaintext and encrypt it. */ 2219 sg_init_table(src, 2); 2220 if (vec->alen) 2221 sg_set_buf(&src[i++], vec->assoc, vec->alen); 2222 if (vec->plen) { 2223 generate_random_bytes((u8 *)vec->ptext, vec->plen); 2224 sg_set_buf(&src[i++], vec->ptext, vec->plen); 2225 } 2226 sg_init_one(&dst, vec->ctext, vec->alen + vec->clen); 2227 memcpy(iv, vec->iv, ivsize); 2228 aead_request_set_callback(req, 0, crypto_req_done, &wait); 2229 aead_request_set_crypt(req, src, &dst, vec->plen, iv); 2230 aead_request_set_ad(req, vec->alen); 2231 vec->crypt_error = crypto_wait_req(crypto_aead_encrypt(req), 2232 &wait); 2233 /* If encryption failed, we're done. */ 2234 if (vec->crypt_error != 0) 2235 return; 2236 memmove((u8 *)vec->ctext, vec->ctext + vec->alen, vec->clen); 2237 if (!inauthentic) 2238 return; 2239 /* 2240 * Mutate the authentic (ciphertext, AAD) pair to get an 2241 * inauthentic one. 2242 */ 2243 mutate_aead_message(vec, suite->aad_iv, ivsize); 2244 } 2245 vec->novrfy = 1; 2246 if (suite->einval_allowed) 2247 vec->crypt_error = -EINVAL; 2248 } 2249 2250 /* 2251 * Generate an AEAD test vector 'vec' using the implementation specified by 2252 * 'req'. The buffers in 'vec' must already be allocated. 2253 * 2254 * If 'prefer_inauthentic' is true, then this function will generate inauthentic 2255 * test vectors (i.e. vectors with 'vec->novrfy=1') more often. 2256 */ 2257 static void generate_random_aead_testvec(struct aead_request *req, 2258 struct aead_testvec *vec, 2259 const struct aead_test_suite *suite, 2260 unsigned int maxkeysize, 2261 unsigned int maxdatasize, 2262 char *name, size_t max_namelen, 2263 bool prefer_inauthentic) 2264 { 2265 struct crypto_aead *tfm = crypto_aead_reqtfm(req); 2266 const unsigned int ivsize = crypto_aead_ivsize(tfm); 2267 const unsigned int maxauthsize = crypto_aead_maxauthsize(tfm); 2268 unsigned int authsize; 2269 unsigned int total_len; 2270 2271 /* Key: length in [0, maxkeysize], but usually choose maxkeysize */ 2272 vec->klen = maxkeysize; 2273 if (prandom_u32() % 4 == 0) 2274 vec->klen = prandom_u32() % (maxkeysize + 1); 2275 generate_random_bytes((u8 *)vec->key, vec->klen); 2276 vec->setkey_error = crypto_aead_setkey(tfm, vec->key, vec->klen); 2277 2278 /* IV */ 2279 generate_random_bytes((u8 *)vec->iv, ivsize); 2280 2281 /* Tag length: in [0, maxauthsize], but usually choose maxauthsize */ 2282 authsize = maxauthsize; 2283 if (prandom_u32() % 4 == 0) 2284 authsize = prandom_u32() % (maxauthsize + 1); 2285 if (prefer_inauthentic && authsize < MIN_COLLISION_FREE_AUTHSIZE) 2286 authsize = MIN_COLLISION_FREE_AUTHSIZE; 2287 if (WARN_ON(authsize > maxdatasize)) 2288 authsize = maxdatasize; 2289 maxdatasize -= authsize; 2290 vec->setauthsize_error = crypto_aead_setauthsize(tfm, authsize); 2291 2292 /* AAD, plaintext, and ciphertext lengths */ 2293 total_len = generate_random_length(maxdatasize); 2294 if (prandom_u32() % 4 == 0) 2295 vec->alen = 0; 2296 else 2297 vec->alen = generate_random_length(total_len); 2298 vec->plen = total_len - vec->alen; 2299 vec->clen = vec->plen + authsize; 2300 2301 /* 2302 * Generate the AAD, plaintext, and ciphertext. Not applicable if the 2303 * key or the authentication tag size couldn't be set. 2304 */ 2305 vec->novrfy = 0; 2306 vec->crypt_error = 0; 2307 if (vec->setkey_error == 0 && vec->setauthsize_error == 0) 2308 generate_aead_message(req, suite, vec, prefer_inauthentic); 2309 snprintf(name, max_namelen, 2310 "\"random: alen=%u plen=%u authsize=%u klen=%u novrfy=%d\"", 2311 vec->alen, vec->plen, authsize, vec->klen, vec->novrfy); 2312 } 2313 2314 static void try_to_generate_inauthentic_testvec( 2315 struct aead_extra_tests_ctx *ctx) 2316 { 2317 int i; 2318 2319 for (i = 0; i < 10; i++) { 2320 generate_random_aead_testvec(ctx->req, &ctx->vec, 2321 &ctx->test_desc->suite.aead, 2322 ctx->maxkeysize, ctx->maxdatasize, 2323 ctx->vec_name, 2324 sizeof(ctx->vec_name), true); 2325 if (ctx->vec.novrfy) 2326 return; 2327 } 2328 } 2329 2330 /* 2331 * Generate inauthentic test vectors (i.e. ciphertext, AAD pairs that aren't the 2332 * result of an encryption with the key) and verify that decryption fails. 2333 */ 2334 static int test_aead_inauthentic_inputs(struct aead_extra_tests_ctx *ctx) 2335 { 2336 unsigned int i; 2337 int err; 2338 2339 for (i = 0; i < fuzz_iterations * 8; i++) { 2340 /* 2341 * Since this part of the tests isn't comparing the 2342 * implementation to another, there's no point in testing any 2343 * test vectors other than inauthentic ones (vec.novrfy=1) here. 2344 * 2345 * If we're having trouble generating such a test vector, e.g. 2346 * if the algorithm keeps rejecting the generated keys, don't 2347 * retry forever; just continue on. 2348 */ 2349 try_to_generate_inauthentic_testvec(ctx); 2350 if (ctx->vec.novrfy) { 2351 generate_random_testvec_config(&ctx->cfg, ctx->cfgname, 2352 sizeof(ctx->cfgname)); 2353 err = test_aead_vec_cfg(DECRYPT, &ctx->vec, 2354 ctx->vec_name, &ctx->cfg, 2355 ctx->req, ctx->tsgls); 2356 if (err) 2357 return err; 2358 } 2359 cond_resched(); 2360 } 2361 return 0; 2362 } 2363 2364 /* 2365 * Test the AEAD algorithm against the corresponding generic implementation, if 2366 * one is available. 2367 */ 2368 static int test_aead_vs_generic_impl(struct aead_extra_tests_ctx *ctx) 2369 { 2370 struct crypto_aead *tfm = ctx->tfm; 2371 const char *algname = crypto_aead_alg(tfm)->base.cra_name; 2372 const char *driver = crypto_aead_driver_name(tfm); 2373 const char *generic_driver = ctx->test_desc->generic_driver; 2374 char _generic_driver[CRYPTO_MAX_ALG_NAME]; 2375 struct crypto_aead *generic_tfm = NULL; 2376 struct aead_request *generic_req = NULL; 2377 unsigned int i; 2378 int err; 2379 2380 if (!generic_driver) { /* Use default naming convention? */ 2381 err = build_generic_driver_name(algname, _generic_driver); 2382 if (err) 2383 return err; 2384 generic_driver = _generic_driver; 2385 } 2386 2387 if (strcmp(generic_driver, driver) == 0) /* Already the generic impl? */ 2388 return 0; 2389 2390 generic_tfm = crypto_alloc_aead(generic_driver, 0, 0); 2391 if (IS_ERR(generic_tfm)) { 2392 err = PTR_ERR(generic_tfm); 2393 if (err == -ENOENT) { 2394 pr_warn("alg: aead: skipping comparison tests for %s because %s is unavailable\n", 2395 driver, generic_driver); 2396 return 0; 2397 } 2398 pr_err("alg: aead: error allocating %s (generic impl of %s): %d\n", 2399 generic_driver, algname, err); 2400 return err; 2401 } 2402 2403 generic_req = aead_request_alloc(generic_tfm, GFP_KERNEL); 2404 if (!generic_req) { 2405 err = -ENOMEM; 2406 goto out; 2407 } 2408 2409 /* Check the algorithm properties for consistency. */ 2410 2411 if (crypto_aead_maxauthsize(tfm) != 2412 crypto_aead_maxauthsize(generic_tfm)) { 2413 pr_err("alg: aead: maxauthsize for %s (%u) doesn't match generic impl (%u)\n", 2414 driver, crypto_aead_maxauthsize(tfm), 2415 crypto_aead_maxauthsize(generic_tfm)); 2416 err = -EINVAL; 2417 goto out; 2418 } 2419 2420 if (crypto_aead_ivsize(tfm) != crypto_aead_ivsize(generic_tfm)) { 2421 pr_err("alg: aead: ivsize for %s (%u) doesn't match generic impl (%u)\n", 2422 driver, crypto_aead_ivsize(tfm), 2423 crypto_aead_ivsize(generic_tfm)); 2424 err = -EINVAL; 2425 goto out; 2426 } 2427 2428 if (crypto_aead_blocksize(tfm) != crypto_aead_blocksize(generic_tfm)) { 2429 pr_err("alg: aead: blocksize for %s (%u) doesn't match generic impl (%u)\n", 2430 driver, crypto_aead_blocksize(tfm), 2431 crypto_aead_blocksize(generic_tfm)); 2432 err = -EINVAL; 2433 goto out; 2434 } 2435 2436 /* 2437 * Now generate test vectors using the generic implementation, and test 2438 * the other implementation against them. 2439 */ 2440 for (i = 0; i < fuzz_iterations * 8; i++) { 2441 generate_random_aead_testvec(generic_req, &ctx->vec, 2442 &ctx->test_desc->suite.aead, 2443 ctx->maxkeysize, ctx->maxdatasize, 2444 ctx->vec_name, 2445 sizeof(ctx->vec_name), false); 2446 generate_random_testvec_config(&ctx->cfg, ctx->cfgname, 2447 sizeof(ctx->cfgname)); 2448 if (!ctx->vec.novrfy) { 2449 err = test_aead_vec_cfg(ENCRYPT, &ctx->vec, 2450 ctx->vec_name, &ctx->cfg, 2451 ctx->req, ctx->tsgls); 2452 if (err) 2453 goto out; 2454 } 2455 if (ctx->vec.crypt_error == 0 || ctx->vec.novrfy) { 2456 err = test_aead_vec_cfg(DECRYPT, &ctx->vec, 2457 ctx->vec_name, &ctx->cfg, 2458 ctx->req, ctx->tsgls); 2459 if (err) 2460 goto out; 2461 } 2462 cond_resched(); 2463 } 2464 err = 0; 2465 out: 2466 crypto_free_aead(generic_tfm); 2467 aead_request_free(generic_req); 2468 return err; 2469 } 2470 2471 static int test_aead_extra(const struct alg_test_desc *test_desc, 2472 struct aead_request *req, 2473 struct cipher_test_sglists *tsgls) 2474 { 2475 struct aead_extra_tests_ctx *ctx; 2476 unsigned int i; 2477 int err; 2478 2479 if (noextratests) 2480 return 0; 2481 2482 ctx = kzalloc(sizeof(*ctx), GFP_KERNEL); 2483 if (!ctx) 2484 return -ENOMEM; 2485 ctx->req = req; 2486 ctx->tfm = crypto_aead_reqtfm(req); 2487 ctx->test_desc = test_desc; 2488 ctx->tsgls = tsgls; 2489 ctx->maxdatasize = (2 * PAGE_SIZE) - TESTMGR_POISON_LEN; 2490 ctx->maxkeysize = 0; 2491 for (i = 0; i < test_desc->suite.aead.count; i++) 2492 ctx->maxkeysize = max_t(unsigned int, ctx->maxkeysize, 2493 test_desc->suite.aead.vecs[i].klen); 2494 2495 ctx->vec.key = kmalloc(ctx->maxkeysize, GFP_KERNEL); 2496 ctx->vec.iv = kmalloc(crypto_aead_ivsize(ctx->tfm), GFP_KERNEL); 2497 ctx->vec.assoc = kmalloc(ctx->maxdatasize, GFP_KERNEL); 2498 ctx->vec.ptext = kmalloc(ctx->maxdatasize, GFP_KERNEL); 2499 ctx->vec.ctext = kmalloc(ctx->maxdatasize, GFP_KERNEL); 2500 if (!ctx->vec.key || !ctx->vec.iv || !ctx->vec.assoc || 2501 !ctx->vec.ptext || !ctx->vec.ctext) { 2502 err = -ENOMEM; 2503 goto out; 2504 } 2505 2506 err = test_aead_vs_generic_impl(ctx); 2507 if (err) 2508 goto out; 2509 2510 err = test_aead_inauthentic_inputs(ctx); 2511 out: 2512 kfree(ctx->vec.key); 2513 kfree(ctx->vec.iv); 2514 kfree(ctx->vec.assoc); 2515 kfree(ctx->vec.ptext); 2516 kfree(ctx->vec.ctext); 2517 kfree(ctx); 2518 return err; 2519 } 2520 #else /* !CONFIG_CRYPTO_MANAGER_EXTRA_TESTS */ 2521 static int test_aead_extra(const struct alg_test_desc *test_desc, 2522 struct aead_request *req, 2523 struct cipher_test_sglists *tsgls) 2524 { 2525 return 0; 2526 } 2527 #endif /* !CONFIG_CRYPTO_MANAGER_EXTRA_TESTS */ 2528 2529 static int test_aead(int enc, const struct aead_test_suite *suite, 2530 struct aead_request *req, 2531 struct cipher_test_sglists *tsgls) 2532 { 2533 unsigned int i; 2534 int err; 2535 2536 for (i = 0; i < suite->count; i++) { 2537 err = test_aead_vec(enc, &suite->vecs[i], i, req, tsgls); 2538 if (err) 2539 return err; 2540 cond_resched(); 2541 } 2542 return 0; 2543 } 2544 2545 static int alg_test_aead(const struct alg_test_desc *desc, const char *driver, 2546 u32 type, u32 mask) 2547 { 2548 const struct aead_test_suite *suite = &desc->suite.aead; 2549 struct crypto_aead *tfm; 2550 struct aead_request *req = NULL; 2551 struct cipher_test_sglists *tsgls = NULL; 2552 int err; 2553 2554 if (suite->count <= 0) { 2555 pr_err("alg: aead: empty test suite for %s\n", driver); 2556 return -EINVAL; 2557 } 2558 2559 tfm = crypto_alloc_aead(driver, type, mask); 2560 if (IS_ERR(tfm)) { 2561 pr_err("alg: aead: failed to allocate transform for %s: %ld\n", 2562 driver, PTR_ERR(tfm)); 2563 return PTR_ERR(tfm); 2564 } 2565 driver = crypto_aead_driver_name(tfm); 2566 2567 req = aead_request_alloc(tfm, GFP_KERNEL); 2568 if (!req) { 2569 pr_err("alg: aead: failed to allocate request for %s\n", 2570 driver); 2571 err = -ENOMEM; 2572 goto out; 2573 } 2574 2575 tsgls = alloc_cipher_test_sglists(); 2576 if (!tsgls) { 2577 pr_err("alg: aead: failed to allocate test buffers for %s\n", 2578 driver); 2579 err = -ENOMEM; 2580 goto out; 2581 } 2582 2583 err = test_aead(ENCRYPT, suite, req, tsgls); 2584 if (err) 2585 goto out; 2586 2587 err = test_aead(DECRYPT, suite, req, tsgls); 2588 if (err) 2589 goto out; 2590 2591 err = test_aead_extra(desc, req, tsgls); 2592 out: 2593 free_cipher_test_sglists(tsgls); 2594 aead_request_free(req); 2595 crypto_free_aead(tfm); 2596 return err; 2597 } 2598 2599 static int test_cipher(struct crypto_cipher *tfm, int enc, 2600 const struct cipher_testvec *template, 2601 unsigned int tcount) 2602 { 2603 const char *algo = crypto_tfm_alg_driver_name(crypto_cipher_tfm(tfm)); 2604 unsigned int i, j, k; 2605 char *q; 2606 const char *e; 2607 const char *input, *result; 2608 void *data; 2609 char *xbuf[XBUFSIZE]; 2610 int ret = -ENOMEM; 2611 2612 if (testmgr_alloc_buf(xbuf)) 2613 goto out_nobuf; 2614 2615 if (enc == ENCRYPT) 2616 e = "encryption"; 2617 else 2618 e = "decryption"; 2619 2620 j = 0; 2621 for (i = 0; i < tcount; i++) { 2622 2623 if (fips_enabled && template[i].fips_skip) 2624 continue; 2625 2626 input = enc ? template[i].ptext : template[i].ctext; 2627 result = enc ? template[i].ctext : template[i].ptext; 2628 j++; 2629 2630 ret = -EINVAL; 2631 if (WARN_ON(template[i].len > PAGE_SIZE)) 2632 goto out; 2633 2634 data = xbuf[0]; 2635 memcpy(data, input, template[i].len); 2636 2637 crypto_cipher_clear_flags(tfm, ~0); 2638 if (template[i].wk) 2639 crypto_cipher_set_flags(tfm, CRYPTO_TFM_REQ_FORBID_WEAK_KEYS); 2640 2641 ret = crypto_cipher_setkey(tfm, template[i].key, 2642 template[i].klen); 2643 if (ret) { 2644 if (ret == template[i].setkey_error) 2645 continue; 2646 pr_err("alg: cipher: %s setkey failed on test vector %u; expected_error=%d, actual_error=%d, flags=%#x\n", 2647 algo, j, template[i].setkey_error, ret, 2648 crypto_cipher_get_flags(tfm)); 2649 goto out; 2650 } 2651 if (template[i].setkey_error) { 2652 pr_err("alg: cipher: %s setkey unexpectedly succeeded on test vector %u; expected_error=%d\n", 2653 algo, j, template[i].setkey_error); 2654 ret = -EINVAL; 2655 goto out; 2656 } 2657 2658 for (k = 0; k < template[i].len; 2659 k += crypto_cipher_blocksize(tfm)) { 2660 if (enc) 2661 crypto_cipher_encrypt_one(tfm, data + k, 2662 data + k); 2663 else 2664 crypto_cipher_decrypt_one(tfm, data + k, 2665 data + k); 2666 } 2667 2668 q = data; 2669 if (memcmp(q, result, template[i].len)) { 2670 printk(KERN_ERR "alg: cipher: Test %d failed " 2671 "on %s for %s\n", j, e, algo); 2672 hexdump(q, template[i].len); 2673 ret = -EINVAL; 2674 goto out; 2675 } 2676 } 2677 2678 ret = 0; 2679 2680 out: 2681 testmgr_free_buf(xbuf); 2682 out_nobuf: 2683 return ret; 2684 } 2685 2686 static int test_skcipher_vec_cfg(int enc, const struct cipher_testvec *vec, 2687 const char *vec_name, 2688 const struct testvec_config *cfg, 2689 struct skcipher_request *req, 2690 struct cipher_test_sglists *tsgls) 2691 { 2692 struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req); 2693 const unsigned int alignmask = crypto_skcipher_alignmask(tfm); 2694 const unsigned int ivsize = crypto_skcipher_ivsize(tfm); 2695 const char *driver = crypto_skcipher_driver_name(tfm); 2696 const u32 req_flags = CRYPTO_TFM_REQ_MAY_BACKLOG | cfg->req_flags; 2697 const char *op = enc ? "encryption" : "decryption"; 2698 DECLARE_CRYPTO_WAIT(wait); 2699 u8 _iv[3 * (MAX_ALGAPI_ALIGNMASK + 1) + MAX_IVLEN]; 2700 u8 *iv = PTR_ALIGN(&_iv[0], 2 * (MAX_ALGAPI_ALIGNMASK + 1)) + 2701 cfg->iv_offset + 2702 (cfg->iv_offset_relative_to_alignmask ? alignmask : 0); 2703 struct kvec input; 2704 int err; 2705 2706 /* Set the key */ 2707 if (vec->wk) 2708 crypto_skcipher_set_flags(tfm, CRYPTO_TFM_REQ_FORBID_WEAK_KEYS); 2709 else 2710 crypto_skcipher_clear_flags(tfm, 2711 CRYPTO_TFM_REQ_FORBID_WEAK_KEYS); 2712 err = do_setkey(crypto_skcipher_setkey, tfm, vec->key, vec->klen, 2713 cfg, alignmask); 2714 if (err) { 2715 if (err == vec->setkey_error) 2716 return 0; 2717 pr_err("alg: skcipher: %s setkey failed on test vector %s; expected_error=%d, actual_error=%d, flags=%#x\n", 2718 driver, vec_name, vec->setkey_error, err, 2719 crypto_skcipher_get_flags(tfm)); 2720 return err; 2721 } 2722 if (vec->setkey_error) { 2723 pr_err("alg: skcipher: %s setkey unexpectedly succeeded on test vector %s; expected_error=%d\n", 2724 driver, vec_name, vec->setkey_error); 2725 return -EINVAL; 2726 } 2727 2728 /* The IV must be copied to a buffer, as the algorithm may modify it */ 2729 if (ivsize) { 2730 if (WARN_ON(ivsize > MAX_IVLEN)) 2731 return -EINVAL; 2732 if (vec->generates_iv && !enc) 2733 memcpy(iv, vec->iv_out, ivsize); 2734 else if (vec->iv) 2735 memcpy(iv, vec->iv, ivsize); 2736 else 2737 memset(iv, 0, ivsize); 2738 } else { 2739 if (vec->generates_iv) { 2740 pr_err("alg: skcipher: %s has ivsize=0 but test vector %s generates IV!\n", 2741 driver, vec_name); 2742 return -EINVAL; 2743 } 2744 iv = NULL; 2745 } 2746 2747 /* Build the src/dst scatterlists */ 2748 input.iov_base = enc ? (void *)vec->ptext : (void *)vec->ctext; 2749 input.iov_len = vec->len; 2750 err = build_cipher_test_sglists(tsgls, cfg, alignmask, 2751 vec->len, vec->len, &input, 1); 2752 if (err) { 2753 pr_err("alg: skcipher: %s %s: error preparing scatterlists for test vector %s, cfg=\"%s\"\n", 2754 driver, op, vec_name, cfg->name); 2755 return err; 2756 } 2757 2758 /* Do the actual encryption or decryption */ 2759 testmgr_poison(req->__ctx, crypto_skcipher_reqsize(tfm)); 2760 skcipher_request_set_callback(req, req_flags, crypto_req_done, &wait); 2761 skcipher_request_set_crypt(req, tsgls->src.sgl_ptr, tsgls->dst.sgl_ptr, 2762 vec->len, iv); 2763 if (cfg->nosimd) 2764 crypto_disable_simd_for_test(); 2765 err = enc ? crypto_skcipher_encrypt(req) : crypto_skcipher_decrypt(req); 2766 if (cfg->nosimd) 2767 crypto_reenable_simd_for_test(); 2768 err = crypto_wait_req(err, &wait); 2769 2770 /* Check that the algorithm didn't overwrite things it shouldn't have */ 2771 if (req->cryptlen != vec->len || 2772 req->iv != iv || 2773 req->src != tsgls->src.sgl_ptr || 2774 req->dst != tsgls->dst.sgl_ptr || 2775 crypto_skcipher_reqtfm(req) != tfm || 2776 req->base.complete != crypto_req_done || 2777 req->base.flags != req_flags || 2778 req->base.data != &wait) { 2779 pr_err("alg: skcipher: %s %s corrupted request struct on test vector %s, cfg=\"%s\"\n", 2780 driver, op, vec_name, cfg->name); 2781 if (req->cryptlen != vec->len) 2782 pr_err("alg: skcipher: changed 'req->cryptlen'\n"); 2783 if (req->iv != iv) 2784 pr_err("alg: skcipher: changed 'req->iv'\n"); 2785 if (req->src != tsgls->src.sgl_ptr) 2786 pr_err("alg: skcipher: changed 'req->src'\n"); 2787 if (req->dst != tsgls->dst.sgl_ptr) 2788 pr_err("alg: skcipher: changed 'req->dst'\n"); 2789 if (crypto_skcipher_reqtfm(req) != tfm) 2790 pr_err("alg: skcipher: changed 'req->base.tfm'\n"); 2791 if (req->base.complete != crypto_req_done) 2792 pr_err("alg: skcipher: changed 'req->base.complete'\n"); 2793 if (req->base.flags != req_flags) 2794 pr_err("alg: skcipher: changed 'req->base.flags'\n"); 2795 if (req->base.data != &wait) 2796 pr_err("alg: skcipher: changed 'req->base.data'\n"); 2797 return -EINVAL; 2798 } 2799 if (is_test_sglist_corrupted(&tsgls->src)) { 2800 pr_err("alg: skcipher: %s %s corrupted src sgl on test vector %s, cfg=\"%s\"\n", 2801 driver, op, vec_name, cfg->name); 2802 return -EINVAL; 2803 } 2804 if (tsgls->dst.sgl_ptr != tsgls->src.sgl && 2805 is_test_sglist_corrupted(&tsgls->dst)) { 2806 pr_err("alg: skcipher: %s %s corrupted dst sgl on test vector %s, cfg=\"%s\"\n", 2807 driver, op, vec_name, cfg->name); 2808 return -EINVAL; 2809 } 2810 2811 /* Check for success or failure */ 2812 if (err) { 2813 if (err == vec->crypt_error) 2814 return 0; 2815 pr_err("alg: skcipher: %s %s failed on test vector %s; expected_error=%d, actual_error=%d, cfg=\"%s\"\n", 2816 driver, op, vec_name, vec->crypt_error, err, cfg->name); 2817 return err; 2818 } 2819 if (vec->crypt_error) { 2820 pr_err("alg: skcipher: %s %s unexpectedly succeeded on test vector %s; expected_error=%d, cfg=\"%s\"\n", 2821 driver, op, vec_name, vec->crypt_error, cfg->name); 2822 return -EINVAL; 2823 } 2824 2825 /* Check for the correct output (ciphertext or plaintext) */ 2826 err = verify_correct_output(&tsgls->dst, enc ? vec->ctext : vec->ptext, 2827 vec->len, 0, true); 2828 if (err == -EOVERFLOW) { 2829 pr_err("alg: skcipher: %s %s overran dst buffer on test vector %s, cfg=\"%s\"\n", 2830 driver, op, vec_name, cfg->name); 2831 return err; 2832 } 2833 if (err) { 2834 pr_err("alg: skcipher: %s %s test failed (wrong result) on test vector %s, cfg=\"%s\"\n", 2835 driver, op, vec_name, cfg->name); 2836 return err; 2837 } 2838 2839 /* If applicable, check that the algorithm generated the correct IV */ 2840 if (vec->iv_out && memcmp(iv, vec->iv_out, ivsize) != 0) { 2841 pr_err("alg: skcipher: %s %s test failed (wrong output IV) on test vector %s, cfg=\"%s\"\n", 2842 driver, op, vec_name, cfg->name); 2843 hexdump(iv, ivsize); 2844 return -EINVAL; 2845 } 2846 2847 return 0; 2848 } 2849 2850 static int test_skcipher_vec(int enc, const struct cipher_testvec *vec, 2851 unsigned int vec_num, 2852 struct skcipher_request *req, 2853 struct cipher_test_sglists *tsgls) 2854 { 2855 char vec_name[16]; 2856 unsigned int i; 2857 int err; 2858 2859 if (fips_enabled && vec->fips_skip) 2860 return 0; 2861 2862 sprintf(vec_name, "%u", vec_num); 2863 2864 for (i = 0; i < ARRAY_SIZE(default_cipher_testvec_configs); i++) { 2865 err = test_skcipher_vec_cfg(enc, vec, vec_name, 2866 &default_cipher_testvec_configs[i], 2867 req, tsgls); 2868 if (err) 2869 return err; 2870 } 2871 2872 #ifdef CONFIG_CRYPTO_MANAGER_EXTRA_TESTS 2873 if (!noextratests) { 2874 struct testvec_config cfg; 2875 char cfgname[TESTVEC_CONFIG_NAMELEN]; 2876 2877 for (i = 0; i < fuzz_iterations; i++) { 2878 generate_random_testvec_config(&cfg, cfgname, 2879 sizeof(cfgname)); 2880 err = test_skcipher_vec_cfg(enc, vec, vec_name, 2881 &cfg, req, tsgls); 2882 if (err) 2883 return err; 2884 cond_resched(); 2885 } 2886 } 2887 #endif 2888 return 0; 2889 } 2890 2891 #ifdef CONFIG_CRYPTO_MANAGER_EXTRA_TESTS 2892 /* 2893 * Generate a symmetric cipher test vector from the given implementation. 2894 * Assumes the buffers in 'vec' were already allocated. 2895 */ 2896 static void generate_random_cipher_testvec(struct skcipher_request *req, 2897 struct cipher_testvec *vec, 2898 unsigned int maxdatasize, 2899 char *name, size_t max_namelen) 2900 { 2901 struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req); 2902 const unsigned int maxkeysize = crypto_skcipher_max_keysize(tfm); 2903 const unsigned int ivsize = crypto_skcipher_ivsize(tfm); 2904 struct scatterlist src, dst; 2905 u8 iv[MAX_IVLEN]; 2906 DECLARE_CRYPTO_WAIT(wait); 2907 2908 /* Key: length in [0, maxkeysize], but usually choose maxkeysize */ 2909 vec->klen = maxkeysize; 2910 if (prandom_u32() % 4 == 0) 2911 vec->klen = prandom_u32() % (maxkeysize + 1); 2912 generate_random_bytes((u8 *)vec->key, vec->klen); 2913 vec->setkey_error = crypto_skcipher_setkey(tfm, vec->key, vec->klen); 2914 2915 /* IV */ 2916 generate_random_bytes((u8 *)vec->iv, ivsize); 2917 2918 /* Plaintext */ 2919 vec->len = generate_random_length(maxdatasize); 2920 generate_random_bytes((u8 *)vec->ptext, vec->len); 2921 2922 /* If the key couldn't be set, no need to continue to encrypt. */ 2923 if (vec->setkey_error) 2924 goto done; 2925 2926 /* Ciphertext */ 2927 sg_init_one(&src, vec->ptext, vec->len); 2928 sg_init_one(&dst, vec->ctext, vec->len); 2929 memcpy(iv, vec->iv, ivsize); 2930 skcipher_request_set_callback(req, 0, crypto_req_done, &wait); 2931 skcipher_request_set_crypt(req, &src, &dst, vec->len, iv); 2932 vec->crypt_error = crypto_wait_req(crypto_skcipher_encrypt(req), &wait); 2933 if (vec->crypt_error != 0) { 2934 /* 2935 * The only acceptable error here is for an invalid length, so 2936 * skcipher decryption should fail with the same error too. 2937 * We'll test for this. But to keep the API usage well-defined, 2938 * explicitly initialize the ciphertext buffer too. 2939 */ 2940 memset((u8 *)vec->ctext, 0, vec->len); 2941 } 2942 done: 2943 snprintf(name, max_namelen, "\"random: len=%u klen=%u\"", 2944 vec->len, vec->klen); 2945 } 2946 2947 /* 2948 * Test the skcipher algorithm represented by @req against the corresponding 2949 * generic implementation, if one is available. 2950 */ 2951 static int test_skcipher_vs_generic_impl(const char *generic_driver, 2952 struct skcipher_request *req, 2953 struct cipher_test_sglists *tsgls) 2954 { 2955 struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req); 2956 const unsigned int maxkeysize = crypto_skcipher_max_keysize(tfm); 2957 const unsigned int ivsize = crypto_skcipher_ivsize(tfm); 2958 const unsigned int blocksize = crypto_skcipher_blocksize(tfm); 2959 const unsigned int maxdatasize = (2 * PAGE_SIZE) - TESTMGR_POISON_LEN; 2960 const char *algname = crypto_skcipher_alg(tfm)->base.cra_name; 2961 const char *driver = crypto_skcipher_driver_name(tfm); 2962 char _generic_driver[CRYPTO_MAX_ALG_NAME]; 2963 struct crypto_skcipher *generic_tfm = NULL; 2964 struct skcipher_request *generic_req = NULL; 2965 unsigned int i; 2966 struct cipher_testvec vec = { 0 }; 2967 char vec_name[64]; 2968 struct testvec_config *cfg; 2969 char cfgname[TESTVEC_CONFIG_NAMELEN]; 2970 int err; 2971 2972 if (noextratests) 2973 return 0; 2974 2975 /* Keywrap isn't supported here yet as it handles its IV differently. */ 2976 if (strncmp(algname, "kw(", 3) == 0) 2977 return 0; 2978 2979 if (!generic_driver) { /* Use default naming convention? */ 2980 err = build_generic_driver_name(algname, _generic_driver); 2981 if (err) 2982 return err; 2983 generic_driver = _generic_driver; 2984 } 2985 2986 if (strcmp(generic_driver, driver) == 0) /* Already the generic impl? */ 2987 return 0; 2988 2989 generic_tfm = crypto_alloc_skcipher(generic_driver, 0, 0); 2990 if (IS_ERR(generic_tfm)) { 2991 err = PTR_ERR(generic_tfm); 2992 if (err == -ENOENT) { 2993 pr_warn("alg: skcipher: skipping comparison tests for %s because %s is unavailable\n", 2994 driver, generic_driver); 2995 return 0; 2996 } 2997 pr_err("alg: skcipher: error allocating %s (generic impl of %s): %d\n", 2998 generic_driver, algname, err); 2999 return err; 3000 } 3001 3002 cfg = kzalloc(sizeof(*cfg), GFP_KERNEL); 3003 if (!cfg) { 3004 err = -ENOMEM; 3005 goto out; 3006 } 3007 3008 generic_req = skcipher_request_alloc(generic_tfm, GFP_KERNEL); 3009 if (!generic_req) { 3010 err = -ENOMEM; 3011 goto out; 3012 } 3013 3014 /* Check the algorithm properties for consistency. */ 3015 3016 if (crypto_skcipher_min_keysize(tfm) != 3017 crypto_skcipher_min_keysize(generic_tfm)) { 3018 pr_err("alg: skcipher: min keysize for %s (%u) doesn't match generic impl (%u)\n", 3019 driver, crypto_skcipher_min_keysize(tfm), 3020 crypto_skcipher_min_keysize(generic_tfm)); 3021 err = -EINVAL; 3022 goto out; 3023 } 3024 3025 if (maxkeysize != crypto_skcipher_max_keysize(generic_tfm)) { 3026 pr_err("alg: skcipher: max keysize for %s (%u) doesn't match generic impl (%u)\n", 3027 driver, maxkeysize, 3028 crypto_skcipher_max_keysize(generic_tfm)); 3029 err = -EINVAL; 3030 goto out; 3031 } 3032 3033 if (ivsize != crypto_skcipher_ivsize(generic_tfm)) { 3034 pr_err("alg: skcipher: ivsize for %s (%u) doesn't match generic impl (%u)\n", 3035 driver, ivsize, crypto_skcipher_ivsize(generic_tfm)); 3036 err = -EINVAL; 3037 goto out; 3038 } 3039 3040 if (blocksize != crypto_skcipher_blocksize(generic_tfm)) { 3041 pr_err("alg: skcipher: blocksize for %s (%u) doesn't match generic impl (%u)\n", 3042 driver, blocksize, 3043 crypto_skcipher_blocksize(generic_tfm)); 3044 err = -EINVAL; 3045 goto out; 3046 } 3047 3048 /* 3049 * Now generate test vectors using the generic implementation, and test 3050 * the other implementation against them. 3051 */ 3052 3053 vec.key = kmalloc(maxkeysize, GFP_KERNEL); 3054 vec.iv = kmalloc(ivsize, GFP_KERNEL); 3055 vec.ptext = kmalloc(maxdatasize, GFP_KERNEL); 3056 vec.ctext = kmalloc(maxdatasize, GFP_KERNEL); 3057 if (!vec.key || !vec.iv || !vec.ptext || !vec.ctext) { 3058 err = -ENOMEM; 3059 goto out; 3060 } 3061 3062 for (i = 0; i < fuzz_iterations * 8; i++) { 3063 generate_random_cipher_testvec(generic_req, &vec, maxdatasize, 3064 vec_name, sizeof(vec_name)); 3065 generate_random_testvec_config(cfg, cfgname, sizeof(cfgname)); 3066 3067 err = test_skcipher_vec_cfg(ENCRYPT, &vec, vec_name, 3068 cfg, req, tsgls); 3069 if (err) 3070 goto out; 3071 err = test_skcipher_vec_cfg(DECRYPT, &vec, vec_name, 3072 cfg, req, tsgls); 3073 if (err) 3074 goto out; 3075 cond_resched(); 3076 } 3077 err = 0; 3078 out: 3079 kfree(cfg); 3080 kfree(vec.key); 3081 kfree(vec.iv); 3082 kfree(vec.ptext); 3083 kfree(vec.ctext); 3084 crypto_free_skcipher(generic_tfm); 3085 skcipher_request_free(generic_req); 3086 return err; 3087 } 3088 #else /* !CONFIG_CRYPTO_MANAGER_EXTRA_TESTS */ 3089 static int test_skcipher_vs_generic_impl(const char *generic_driver, 3090 struct skcipher_request *req, 3091 struct cipher_test_sglists *tsgls) 3092 { 3093 return 0; 3094 } 3095 #endif /* !CONFIG_CRYPTO_MANAGER_EXTRA_TESTS */ 3096 3097 static int test_skcipher(int enc, const struct cipher_test_suite *suite, 3098 struct skcipher_request *req, 3099 struct cipher_test_sglists *tsgls) 3100 { 3101 unsigned int i; 3102 int err; 3103 3104 for (i = 0; i < suite->count; i++) { 3105 err = test_skcipher_vec(enc, &suite->vecs[i], i, req, tsgls); 3106 if (err) 3107 return err; 3108 cond_resched(); 3109 } 3110 return 0; 3111 } 3112 3113 static int alg_test_skcipher(const struct alg_test_desc *desc, 3114 const char *driver, u32 type, u32 mask) 3115 { 3116 const struct cipher_test_suite *suite = &desc->suite.cipher; 3117 struct crypto_skcipher *tfm; 3118 struct skcipher_request *req = NULL; 3119 struct cipher_test_sglists *tsgls = NULL; 3120 int err; 3121 3122 if (suite->count <= 0) { 3123 pr_err("alg: skcipher: empty test suite for %s\n", driver); 3124 return -EINVAL; 3125 } 3126 3127 tfm = crypto_alloc_skcipher(driver, type, mask); 3128 if (IS_ERR(tfm)) { 3129 pr_err("alg: skcipher: failed to allocate transform for %s: %ld\n", 3130 driver, PTR_ERR(tfm)); 3131 return PTR_ERR(tfm); 3132 } 3133 driver = crypto_skcipher_driver_name(tfm); 3134 3135 req = skcipher_request_alloc(tfm, GFP_KERNEL); 3136 if (!req) { 3137 pr_err("alg: skcipher: failed to allocate request for %s\n", 3138 driver); 3139 err = -ENOMEM; 3140 goto out; 3141 } 3142 3143 tsgls = alloc_cipher_test_sglists(); 3144 if (!tsgls) { 3145 pr_err("alg: skcipher: failed to allocate test buffers for %s\n", 3146 driver); 3147 err = -ENOMEM; 3148 goto out; 3149 } 3150 3151 err = test_skcipher(ENCRYPT, suite, req, tsgls); 3152 if (err) 3153 goto out; 3154 3155 err = test_skcipher(DECRYPT, suite, req, tsgls); 3156 if (err) 3157 goto out; 3158 3159 err = test_skcipher_vs_generic_impl(desc->generic_driver, req, tsgls); 3160 out: 3161 free_cipher_test_sglists(tsgls); 3162 skcipher_request_free(req); 3163 crypto_free_skcipher(tfm); 3164 return err; 3165 } 3166 3167 static int test_comp(struct crypto_comp *tfm, 3168 const struct comp_testvec *ctemplate, 3169 const struct comp_testvec *dtemplate, 3170 int ctcount, int dtcount) 3171 { 3172 const char *algo = crypto_tfm_alg_driver_name(crypto_comp_tfm(tfm)); 3173 char *output, *decomp_output; 3174 unsigned int i; 3175 int ret; 3176 3177 output = kmalloc(COMP_BUF_SIZE, GFP_KERNEL); 3178 if (!output) 3179 return -ENOMEM; 3180 3181 decomp_output = kmalloc(COMP_BUF_SIZE, GFP_KERNEL); 3182 if (!decomp_output) { 3183 kfree(output); 3184 return -ENOMEM; 3185 } 3186 3187 for (i = 0; i < ctcount; i++) { 3188 int ilen; 3189 unsigned int dlen = COMP_BUF_SIZE; 3190 3191 memset(output, 0, COMP_BUF_SIZE); 3192 memset(decomp_output, 0, COMP_BUF_SIZE); 3193 3194 ilen = ctemplate[i].inlen; 3195 ret = crypto_comp_compress(tfm, ctemplate[i].input, 3196 ilen, output, &dlen); 3197 if (ret) { 3198 printk(KERN_ERR "alg: comp: compression failed " 3199 "on test %d for %s: ret=%d\n", i + 1, algo, 3200 -ret); 3201 goto out; 3202 } 3203 3204 ilen = dlen; 3205 dlen = COMP_BUF_SIZE; 3206 ret = crypto_comp_decompress(tfm, output, 3207 ilen, decomp_output, &dlen); 3208 if (ret) { 3209 pr_err("alg: comp: compression failed: decompress: on test %d for %s failed: ret=%d\n", 3210 i + 1, algo, -ret); 3211 goto out; 3212 } 3213 3214 if (dlen != ctemplate[i].inlen) { 3215 printk(KERN_ERR "alg: comp: Compression test %d " 3216 "failed for %s: output len = %d\n", i + 1, algo, 3217 dlen); 3218 ret = -EINVAL; 3219 goto out; 3220 } 3221 3222 if (memcmp(decomp_output, ctemplate[i].input, 3223 ctemplate[i].inlen)) { 3224 pr_err("alg: comp: compression failed: output differs: on test %d for %s\n", 3225 i + 1, algo); 3226 hexdump(decomp_output, dlen); 3227 ret = -EINVAL; 3228 goto out; 3229 } 3230 } 3231 3232 for (i = 0; i < dtcount; i++) { 3233 int ilen; 3234 unsigned int dlen = COMP_BUF_SIZE; 3235 3236 memset(decomp_output, 0, COMP_BUF_SIZE); 3237 3238 ilen = dtemplate[i].inlen; 3239 ret = crypto_comp_decompress(tfm, dtemplate[i].input, 3240 ilen, decomp_output, &dlen); 3241 if (ret) { 3242 printk(KERN_ERR "alg: comp: decompression failed " 3243 "on test %d for %s: ret=%d\n", i + 1, algo, 3244 -ret); 3245 goto out; 3246 } 3247 3248 if (dlen != dtemplate[i].outlen) { 3249 printk(KERN_ERR "alg: comp: Decompression test %d " 3250 "failed for %s: output len = %d\n", i + 1, algo, 3251 dlen); 3252 ret = -EINVAL; 3253 goto out; 3254 } 3255 3256 if (memcmp(decomp_output, dtemplate[i].output, dlen)) { 3257 printk(KERN_ERR "alg: comp: Decompression test %d " 3258 "failed for %s\n", i + 1, algo); 3259 hexdump(decomp_output, dlen); 3260 ret = -EINVAL; 3261 goto out; 3262 } 3263 } 3264 3265 ret = 0; 3266 3267 out: 3268 kfree(decomp_output); 3269 kfree(output); 3270 return ret; 3271 } 3272 3273 static int test_acomp(struct crypto_acomp *tfm, 3274 const struct comp_testvec *ctemplate, 3275 const struct comp_testvec *dtemplate, 3276 int ctcount, int dtcount) 3277 { 3278 const char *algo = crypto_tfm_alg_driver_name(crypto_acomp_tfm(tfm)); 3279 unsigned int i; 3280 char *output, *decomp_out; 3281 int ret; 3282 struct scatterlist src, dst; 3283 struct acomp_req *req; 3284 struct crypto_wait wait; 3285 3286 output = kmalloc(COMP_BUF_SIZE, GFP_KERNEL); 3287 if (!output) 3288 return -ENOMEM; 3289 3290 decomp_out = kmalloc(COMP_BUF_SIZE, GFP_KERNEL); 3291 if (!decomp_out) { 3292 kfree(output); 3293 return -ENOMEM; 3294 } 3295 3296 for (i = 0; i < ctcount; i++) { 3297 unsigned int dlen = COMP_BUF_SIZE; 3298 int ilen = ctemplate[i].inlen; 3299 void *input_vec; 3300 3301 input_vec = kmemdup(ctemplate[i].input, ilen, GFP_KERNEL); 3302 if (!input_vec) { 3303 ret = -ENOMEM; 3304 goto out; 3305 } 3306 3307 memset(output, 0, dlen); 3308 crypto_init_wait(&wait); 3309 sg_init_one(&src, input_vec, ilen); 3310 sg_init_one(&dst, output, dlen); 3311 3312 req = acomp_request_alloc(tfm); 3313 if (!req) { 3314 pr_err("alg: acomp: request alloc failed for %s\n", 3315 algo); 3316 kfree(input_vec); 3317 ret = -ENOMEM; 3318 goto out; 3319 } 3320 3321 acomp_request_set_params(req, &src, &dst, ilen, dlen); 3322 acomp_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG, 3323 crypto_req_done, &wait); 3324 3325 ret = crypto_wait_req(crypto_acomp_compress(req), &wait); 3326 if (ret) { 3327 pr_err("alg: acomp: compression failed on test %d for %s: ret=%d\n", 3328 i + 1, algo, -ret); 3329 kfree(input_vec); 3330 acomp_request_free(req); 3331 goto out; 3332 } 3333 3334 ilen = req->dlen; 3335 dlen = COMP_BUF_SIZE; 3336 sg_init_one(&src, output, ilen); 3337 sg_init_one(&dst, decomp_out, dlen); 3338 crypto_init_wait(&wait); 3339 acomp_request_set_params(req, &src, &dst, ilen, dlen); 3340 3341 ret = crypto_wait_req(crypto_acomp_decompress(req), &wait); 3342 if (ret) { 3343 pr_err("alg: acomp: compression failed on test %d for %s: ret=%d\n", 3344 i + 1, algo, -ret); 3345 kfree(input_vec); 3346 acomp_request_free(req); 3347 goto out; 3348 } 3349 3350 if (req->dlen != ctemplate[i].inlen) { 3351 pr_err("alg: acomp: Compression test %d failed for %s: output len = %d\n", 3352 i + 1, algo, req->dlen); 3353 ret = -EINVAL; 3354 kfree(input_vec); 3355 acomp_request_free(req); 3356 goto out; 3357 } 3358 3359 if (memcmp(input_vec, decomp_out, req->dlen)) { 3360 pr_err("alg: acomp: Compression test %d failed for %s\n", 3361 i + 1, algo); 3362 hexdump(output, req->dlen); 3363 ret = -EINVAL; 3364 kfree(input_vec); 3365 acomp_request_free(req); 3366 goto out; 3367 } 3368 3369 kfree(input_vec); 3370 acomp_request_free(req); 3371 } 3372 3373 for (i = 0; i < dtcount; i++) { 3374 unsigned int dlen = COMP_BUF_SIZE; 3375 int ilen = dtemplate[i].inlen; 3376 void *input_vec; 3377 3378 input_vec = kmemdup(dtemplate[i].input, ilen, GFP_KERNEL); 3379 if (!input_vec) { 3380 ret = -ENOMEM; 3381 goto out; 3382 } 3383 3384 memset(output, 0, dlen); 3385 crypto_init_wait(&wait); 3386 sg_init_one(&src, input_vec, ilen); 3387 sg_init_one(&dst, output, dlen); 3388 3389 req = acomp_request_alloc(tfm); 3390 if (!req) { 3391 pr_err("alg: acomp: request alloc failed for %s\n", 3392 algo); 3393 kfree(input_vec); 3394 ret = -ENOMEM; 3395 goto out; 3396 } 3397 3398 acomp_request_set_params(req, &src, &dst, ilen, dlen); 3399 acomp_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG, 3400 crypto_req_done, &wait); 3401 3402 ret = crypto_wait_req(crypto_acomp_decompress(req), &wait); 3403 if (ret) { 3404 pr_err("alg: acomp: decompression failed on test %d for %s: ret=%d\n", 3405 i + 1, algo, -ret); 3406 kfree(input_vec); 3407 acomp_request_free(req); 3408 goto out; 3409 } 3410 3411 if (req->dlen != dtemplate[i].outlen) { 3412 pr_err("alg: acomp: Decompression test %d failed for %s: output len = %d\n", 3413 i + 1, algo, req->dlen); 3414 ret = -EINVAL; 3415 kfree(input_vec); 3416 acomp_request_free(req); 3417 goto out; 3418 } 3419 3420 if (memcmp(output, dtemplate[i].output, req->dlen)) { 3421 pr_err("alg: acomp: Decompression test %d failed for %s\n", 3422 i + 1, algo); 3423 hexdump(output, req->dlen); 3424 ret = -EINVAL; 3425 kfree(input_vec); 3426 acomp_request_free(req); 3427 goto out; 3428 } 3429 3430 kfree(input_vec); 3431 acomp_request_free(req); 3432 } 3433 3434 ret = 0; 3435 3436 out: 3437 kfree(decomp_out); 3438 kfree(output); 3439 return ret; 3440 } 3441 3442 static int test_cprng(struct crypto_rng *tfm, 3443 const struct cprng_testvec *template, 3444 unsigned int tcount) 3445 { 3446 const char *algo = crypto_tfm_alg_driver_name(crypto_rng_tfm(tfm)); 3447 int err = 0, i, j, seedsize; 3448 u8 *seed; 3449 char result[32]; 3450 3451 seedsize = crypto_rng_seedsize(tfm); 3452 3453 seed = kmalloc(seedsize, GFP_KERNEL); 3454 if (!seed) { 3455 printk(KERN_ERR "alg: cprng: Failed to allocate seed space " 3456 "for %s\n", algo); 3457 return -ENOMEM; 3458 } 3459 3460 for (i = 0; i < tcount; i++) { 3461 memset(result, 0, 32); 3462 3463 memcpy(seed, template[i].v, template[i].vlen); 3464 memcpy(seed + template[i].vlen, template[i].key, 3465 template[i].klen); 3466 memcpy(seed + template[i].vlen + template[i].klen, 3467 template[i].dt, template[i].dtlen); 3468 3469 err = crypto_rng_reset(tfm, seed, seedsize); 3470 if (err) { 3471 printk(KERN_ERR "alg: cprng: Failed to reset rng " 3472 "for %s\n", algo); 3473 goto out; 3474 } 3475 3476 for (j = 0; j < template[i].loops; j++) { 3477 err = crypto_rng_get_bytes(tfm, result, 3478 template[i].rlen); 3479 if (err < 0) { 3480 printk(KERN_ERR "alg: cprng: Failed to obtain " 3481 "the correct amount of random data for " 3482 "%s (requested %d)\n", algo, 3483 template[i].rlen); 3484 goto out; 3485 } 3486 } 3487 3488 err = memcmp(result, template[i].result, 3489 template[i].rlen); 3490 if (err) { 3491 printk(KERN_ERR "alg: cprng: Test %d failed for %s\n", 3492 i, algo); 3493 hexdump(result, template[i].rlen); 3494 err = -EINVAL; 3495 goto out; 3496 } 3497 } 3498 3499 out: 3500 kfree(seed); 3501 return err; 3502 } 3503 3504 static int alg_test_cipher(const struct alg_test_desc *desc, 3505 const char *driver, u32 type, u32 mask) 3506 { 3507 const struct cipher_test_suite *suite = &desc->suite.cipher; 3508 struct crypto_cipher *tfm; 3509 int err; 3510 3511 tfm = crypto_alloc_cipher(driver, type, mask); 3512 if (IS_ERR(tfm)) { 3513 printk(KERN_ERR "alg: cipher: Failed to load transform for " 3514 "%s: %ld\n", driver, PTR_ERR(tfm)); 3515 return PTR_ERR(tfm); 3516 } 3517 3518 err = test_cipher(tfm, ENCRYPT, suite->vecs, suite->count); 3519 if (!err) 3520 err = test_cipher(tfm, DECRYPT, suite->vecs, suite->count); 3521 3522 crypto_free_cipher(tfm); 3523 return err; 3524 } 3525 3526 static int alg_test_comp(const struct alg_test_desc *desc, const char *driver, 3527 u32 type, u32 mask) 3528 { 3529 struct crypto_comp *comp; 3530 struct crypto_acomp *acomp; 3531 int err; 3532 u32 algo_type = type & CRYPTO_ALG_TYPE_ACOMPRESS_MASK; 3533 3534 if (algo_type == CRYPTO_ALG_TYPE_ACOMPRESS) { 3535 acomp = crypto_alloc_acomp(driver, type, mask); 3536 if (IS_ERR(acomp)) { 3537 pr_err("alg: acomp: Failed to load transform for %s: %ld\n", 3538 driver, PTR_ERR(acomp)); 3539 return PTR_ERR(acomp); 3540 } 3541 err = test_acomp(acomp, desc->suite.comp.comp.vecs, 3542 desc->suite.comp.decomp.vecs, 3543 desc->suite.comp.comp.count, 3544 desc->suite.comp.decomp.count); 3545 crypto_free_acomp(acomp); 3546 } else { 3547 comp = crypto_alloc_comp(driver, type, mask); 3548 if (IS_ERR(comp)) { 3549 pr_err("alg: comp: Failed to load transform for %s: %ld\n", 3550 driver, PTR_ERR(comp)); 3551 return PTR_ERR(comp); 3552 } 3553 3554 err = test_comp(comp, desc->suite.comp.comp.vecs, 3555 desc->suite.comp.decomp.vecs, 3556 desc->suite.comp.comp.count, 3557 desc->suite.comp.decomp.count); 3558 3559 crypto_free_comp(comp); 3560 } 3561 return err; 3562 } 3563 3564 static int alg_test_crc32c(const struct alg_test_desc *desc, 3565 const char *driver, u32 type, u32 mask) 3566 { 3567 struct crypto_shash *tfm; 3568 __le32 val; 3569 int err; 3570 3571 err = alg_test_hash(desc, driver, type, mask); 3572 if (err) 3573 return err; 3574 3575 tfm = crypto_alloc_shash(driver, type, mask); 3576 if (IS_ERR(tfm)) { 3577 if (PTR_ERR(tfm) == -ENOENT) { 3578 /* 3579 * This crc32c implementation is only available through 3580 * ahash API, not the shash API, so the remaining part 3581 * of the test is not applicable to it. 3582 */ 3583 return 0; 3584 } 3585 printk(KERN_ERR "alg: crc32c: Failed to load transform for %s: " 3586 "%ld\n", driver, PTR_ERR(tfm)); 3587 return PTR_ERR(tfm); 3588 } 3589 driver = crypto_shash_driver_name(tfm); 3590 3591 do { 3592 SHASH_DESC_ON_STACK(shash, tfm); 3593 u32 *ctx = (u32 *)shash_desc_ctx(shash); 3594 3595 shash->tfm = tfm; 3596 3597 *ctx = 420553207; 3598 err = crypto_shash_final(shash, (u8 *)&val); 3599 if (err) { 3600 printk(KERN_ERR "alg: crc32c: Operation failed for " 3601 "%s: %d\n", driver, err); 3602 break; 3603 } 3604 3605 if (val != cpu_to_le32(~420553207)) { 3606 pr_err("alg: crc32c: Test failed for %s: %u\n", 3607 driver, le32_to_cpu(val)); 3608 err = -EINVAL; 3609 } 3610 } while (0); 3611 3612 crypto_free_shash(tfm); 3613 3614 return err; 3615 } 3616 3617 static int alg_test_cprng(const struct alg_test_desc *desc, const char *driver, 3618 u32 type, u32 mask) 3619 { 3620 struct crypto_rng *rng; 3621 int err; 3622 3623 rng = crypto_alloc_rng(driver, type, mask); 3624 if (IS_ERR(rng)) { 3625 printk(KERN_ERR "alg: cprng: Failed to load transform for %s: " 3626 "%ld\n", driver, PTR_ERR(rng)); 3627 return PTR_ERR(rng); 3628 } 3629 3630 err = test_cprng(rng, desc->suite.cprng.vecs, desc->suite.cprng.count); 3631 3632 crypto_free_rng(rng); 3633 3634 return err; 3635 } 3636 3637 3638 static int drbg_cavs_test(const struct drbg_testvec *test, int pr, 3639 const char *driver, u32 type, u32 mask) 3640 { 3641 int ret = -EAGAIN; 3642 struct crypto_rng *drng; 3643 struct drbg_test_data test_data; 3644 struct drbg_string addtl, pers, testentropy; 3645 unsigned char *buf = kzalloc(test->expectedlen, GFP_KERNEL); 3646 3647 if (!buf) 3648 return -ENOMEM; 3649 3650 drng = crypto_alloc_rng(driver, type, mask); 3651 if (IS_ERR(drng)) { 3652 printk(KERN_ERR "alg: drbg: could not allocate DRNG handle for " 3653 "%s\n", driver); 3654 kfree_sensitive(buf); 3655 return -ENOMEM; 3656 } 3657 3658 test_data.testentropy = &testentropy; 3659 drbg_string_fill(&testentropy, test->entropy, test->entropylen); 3660 drbg_string_fill(&pers, test->pers, test->perslen); 3661 ret = crypto_drbg_reset_test(drng, &pers, &test_data); 3662 if (ret) { 3663 printk(KERN_ERR "alg: drbg: Failed to reset rng\n"); 3664 goto outbuf; 3665 } 3666 3667 drbg_string_fill(&addtl, test->addtla, test->addtllen); 3668 if (pr) { 3669 drbg_string_fill(&testentropy, test->entpra, test->entprlen); 3670 ret = crypto_drbg_get_bytes_addtl_test(drng, 3671 buf, test->expectedlen, &addtl, &test_data); 3672 } else { 3673 ret = crypto_drbg_get_bytes_addtl(drng, 3674 buf, test->expectedlen, &addtl); 3675 } 3676 if (ret < 0) { 3677 printk(KERN_ERR "alg: drbg: could not obtain random data for " 3678 "driver %s\n", driver); 3679 goto outbuf; 3680 } 3681 3682 drbg_string_fill(&addtl, test->addtlb, test->addtllen); 3683 if (pr) { 3684 drbg_string_fill(&testentropy, test->entprb, test->entprlen); 3685 ret = crypto_drbg_get_bytes_addtl_test(drng, 3686 buf, test->expectedlen, &addtl, &test_data); 3687 } else { 3688 ret = crypto_drbg_get_bytes_addtl(drng, 3689 buf, test->expectedlen, &addtl); 3690 } 3691 if (ret < 0) { 3692 printk(KERN_ERR "alg: drbg: could not obtain random data for " 3693 "driver %s\n", driver); 3694 goto outbuf; 3695 } 3696 3697 ret = memcmp(test->expected, buf, test->expectedlen); 3698 3699 outbuf: 3700 crypto_free_rng(drng); 3701 kfree_sensitive(buf); 3702 return ret; 3703 } 3704 3705 3706 static int alg_test_drbg(const struct alg_test_desc *desc, const char *driver, 3707 u32 type, u32 mask) 3708 { 3709 int err = 0; 3710 int pr = 0; 3711 int i = 0; 3712 const struct drbg_testvec *template = desc->suite.drbg.vecs; 3713 unsigned int tcount = desc->suite.drbg.count; 3714 3715 if (0 == memcmp(driver, "drbg_pr_", 8)) 3716 pr = 1; 3717 3718 for (i = 0; i < tcount; i++) { 3719 err = drbg_cavs_test(&template[i], pr, driver, type, mask); 3720 if (err) { 3721 printk(KERN_ERR "alg: drbg: Test %d failed for %s\n", 3722 i, driver); 3723 err = -EINVAL; 3724 break; 3725 } 3726 } 3727 return err; 3728 3729 } 3730 3731 static int do_test_kpp(struct crypto_kpp *tfm, const struct kpp_testvec *vec, 3732 const char *alg) 3733 { 3734 struct kpp_request *req; 3735 void *input_buf = NULL; 3736 void *output_buf = NULL; 3737 void *a_public = NULL; 3738 void *a_ss = NULL; 3739 void *shared_secret = NULL; 3740 struct crypto_wait wait; 3741 unsigned int out_len_max; 3742 int err = -ENOMEM; 3743 struct scatterlist src, dst; 3744 3745 req = kpp_request_alloc(tfm, GFP_KERNEL); 3746 if (!req) 3747 return err; 3748 3749 crypto_init_wait(&wait); 3750 3751 err = crypto_kpp_set_secret(tfm, vec->secret, vec->secret_size); 3752 if (err < 0) 3753 goto free_req; 3754 3755 out_len_max = crypto_kpp_maxsize(tfm); 3756 output_buf = kzalloc(out_len_max, GFP_KERNEL); 3757 if (!output_buf) { 3758 err = -ENOMEM; 3759 goto free_req; 3760 } 3761 3762 /* Use appropriate parameter as base */ 3763 kpp_request_set_input(req, NULL, 0); 3764 sg_init_one(&dst, output_buf, out_len_max); 3765 kpp_request_set_output(req, &dst, out_len_max); 3766 kpp_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG, 3767 crypto_req_done, &wait); 3768 3769 /* Compute party A's public key */ 3770 err = crypto_wait_req(crypto_kpp_generate_public_key(req), &wait); 3771 if (err) { 3772 pr_err("alg: %s: Party A: generate public key test failed. err %d\n", 3773 alg, err); 3774 goto free_output; 3775 } 3776 3777 if (vec->genkey) { 3778 /* Save party A's public key */ 3779 a_public = kmemdup(sg_virt(req->dst), out_len_max, GFP_KERNEL); 3780 if (!a_public) { 3781 err = -ENOMEM; 3782 goto free_output; 3783 } 3784 } else { 3785 /* Verify calculated public key */ 3786 if (memcmp(vec->expected_a_public, sg_virt(req->dst), 3787 vec->expected_a_public_size)) { 3788 pr_err("alg: %s: Party A: generate public key test failed. Invalid output\n", 3789 alg); 3790 err = -EINVAL; 3791 goto free_output; 3792 } 3793 } 3794 3795 /* Calculate shared secret key by using counter part (b) public key. */ 3796 input_buf = kmemdup(vec->b_public, vec->b_public_size, GFP_KERNEL); 3797 if (!input_buf) { 3798 err = -ENOMEM; 3799 goto free_output; 3800 } 3801 3802 sg_init_one(&src, input_buf, vec->b_public_size); 3803 sg_init_one(&dst, output_buf, out_len_max); 3804 kpp_request_set_input(req, &src, vec->b_public_size); 3805 kpp_request_set_output(req, &dst, out_len_max); 3806 kpp_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG, 3807 crypto_req_done, &wait); 3808 err = crypto_wait_req(crypto_kpp_compute_shared_secret(req), &wait); 3809 if (err) { 3810 pr_err("alg: %s: Party A: compute shared secret test failed. err %d\n", 3811 alg, err); 3812 goto free_all; 3813 } 3814 3815 if (vec->genkey) { 3816 /* Save the shared secret obtained by party A */ 3817 a_ss = kmemdup(sg_virt(req->dst), vec->expected_ss_size, GFP_KERNEL); 3818 if (!a_ss) { 3819 err = -ENOMEM; 3820 goto free_all; 3821 } 3822 3823 /* 3824 * Calculate party B's shared secret by using party A's 3825 * public key. 3826 */ 3827 err = crypto_kpp_set_secret(tfm, vec->b_secret, 3828 vec->b_secret_size); 3829 if (err < 0) 3830 goto free_all; 3831 3832 sg_init_one(&src, a_public, vec->expected_a_public_size); 3833 sg_init_one(&dst, output_buf, out_len_max); 3834 kpp_request_set_input(req, &src, vec->expected_a_public_size); 3835 kpp_request_set_output(req, &dst, out_len_max); 3836 kpp_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG, 3837 crypto_req_done, &wait); 3838 err = crypto_wait_req(crypto_kpp_compute_shared_secret(req), 3839 &wait); 3840 if (err) { 3841 pr_err("alg: %s: Party B: compute shared secret failed. err %d\n", 3842 alg, err); 3843 goto free_all; 3844 } 3845 3846 shared_secret = a_ss; 3847 } else { 3848 shared_secret = (void *)vec->expected_ss; 3849 } 3850 3851 /* 3852 * verify shared secret from which the user will derive 3853 * secret key by executing whatever hash it has chosen 3854 */ 3855 if (memcmp(shared_secret, sg_virt(req->dst), 3856 vec->expected_ss_size)) { 3857 pr_err("alg: %s: compute shared secret test failed. Invalid output\n", 3858 alg); 3859 err = -EINVAL; 3860 } 3861 3862 free_all: 3863 kfree(a_ss); 3864 kfree(input_buf); 3865 free_output: 3866 kfree(a_public); 3867 kfree(output_buf); 3868 free_req: 3869 kpp_request_free(req); 3870 return err; 3871 } 3872 3873 static int test_kpp(struct crypto_kpp *tfm, const char *alg, 3874 const struct kpp_testvec *vecs, unsigned int tcount) 3875 { 3876 int ret, i; 3877 3878 for (i = 0; i < tcount; i++) { 3879 ret = do_test_kpp(tfm, vecs++, alg); 3880 if (ret) { 3881 pr_err("alg: %s: test failed on vector %d, err=%d\n", 3882 alg, i + 1, ret); 3883 return ret; 3884 } 3885 } 3886 return 0; 3887 } 3888 3889 static int alg_test_kpp(const struct alg_test_desc *desc, const char *driver, 3890 u32 type, u32 mask) 3891 { 3892 struct crypto_kpp *tfm; 3893 int err = 0; 3894 3895 tfm = crypto_alloc_kpp(driver, type, mask); 3896 if (IS_ERR(tfm)) { 3897 pr_err("alg: kpp: Failed to load tfm for %s: %ld\n", 3898 driver, PTR_ERR(tfm)); 3899 return PTR_ERR(tfm); 3900 } 3901 if (desc->suite.kpp.vecs) 3902 err = test_kpp(tfm, desc->alg, desc->suite.kpp.vecs, 3903 desc->suite.kpp.count); 3904 3905 crypto_free_kpp(tfm); 3906 return err; 3907 } 3908 3909 static u8 *test_pack_u32(u8 *dst, u32 val) 3910 { 3911 memcpy(dst, &val, sizeof(val)); 3912 return dst + sizeof(val); 3913 } 3914 3915 static int test_akcipher_one(struct crypto_akcipher *tfm, 3916 const struct akcipher_testvec *vecs) 3917 { 3918 char *xbuf[XBUFSIZE]; 3919 struct akcipher_request *req; 3920 void *outbuf_enc = NULL; 3921 void *outbuf_dec = NULL; 3922 struct crypto_wait wait; 3923 unsigned int out_len_max, out_len = 0; 3924 int err = -ENOMEM; 3925 struct scatterlist src, dst, src_tab[3]; 3926 const char *m, *c; 3927 unsigned int m_size, c_size; 3928 const char *op; 3929 u8 *key, *ptr; 3930 3931 if (testmgr_alloc_buf(xbuf)) 3932 return err; 3933 3934 req = akcipher_request_alloc(tfm, GFP_KERNEL); 3935 if (!req) 3936 goto free_xbuf; 3937 3938 crypto_init_wait(&wait); 3939 3940 key = kmalloc(vecs->key_len + sizeof(u32) * 2 + vecs->param_len, 3941 GFP_KERNEL); 3942 if (!key) 3943 goto free_req; 3944 memcpy(key, vecs->key, vecs->key_len); 3945 ptr = key + vecs->key_len; 3946 ptr = test_pack_u32(ptr, vecs->algo); 3947 ptr = test_pack_u32(ptr, vecs->param_len); 3948 memcpy(ptr, vecs->params, vecs->param_len); 3949 3950 if (vecs->public_key_vec) 3951 err = crypto_akcipher_set_pub_key(tfm, key, vecs->key_len); 3952 else 3953 err = crypto_akcipher_set_priv_key(tfm, key, vecs->key_len); 3954 if (err) 3955 goto free_key; 3956 3957 /* 3958 * First run test which do not require a private key, such as 3959 * encrypt or verify. 3960 */ 3961 err = -ENOMEM; 3962 out_len_max = crypto_akcipher_maxsize(tfm); 3963 outbuf_enc = kzalloc(out_len_max, GFP_KERNEL); 3964 if (!outbuf_enc) 3965 goto free_key; 3966 3967 if (!vecs->siggen_sigver_test) { 3968 m = vecs->m; 3969 m_size = vecs->m_size; 3970 c = vecs->c; 3971 c_size = vecs->c_size; 3972 op = "encrypt"; 3973 } else { 3974 /* Swap args so we could keep plaintext (digest) 3975 * in vecs->m, and cooked signature in vecs->c. 3976 */ 3977 m = vecs->c; /* signature */ 3978 m_size = vecs->c_size; 3979 c = vecs->m; /* digest */ 3980 c_size = vecs->m_size; 3981 op = "verify"; 3982 } 3983 3984 err = -E2BIG; 3985 if (WARN_ON(m_size > PAGE_SIZE)) 3986 goto free_all; 3987 memcpy(xbuf[0], m, m_size); 3988 3989 sg_init_table(src_tab, 3); 3990 sg_set_buf(&src_tab[0], xbuf[0], 8); 3991 sg_set_buf(&src_tab[1], xbuf[0] + 8, m_size - 8); 3992 if (vecs->siggen_sigver_test) { 3993 if (WARN_ON(c_size > PAGE_SIZE)) 3994 goto free_all; 3995 memcpy(xbuf[1], c, c_size); 3996 sg_set_buf(&src_tab[2], xbuf[1], c_size); 3997 akcipher_request_set_crypt(req, src_tab, NULL, m_size, c_size); 3998 } else { 3999 sg_init_one(&dst, outbuf_enc, out_len_max); 4000 akcipher_request_set_crypt(req, src_tab, &dst, m_size, 4001 out_len_max); 4002 } 4003 akcipher_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG, 4004 crypto_req_done, &wait); 4005 4006 err = crypto_wait_req(vecs->siggen_sigver_test ? 4007 /* Run asymmetric signature verification */ 4008 crypto_akcipher_verify(req) : 4009 /* Run asymmetric encrypt */ 4010 crypto_akcipher_encrypt(req), &wait); 4011 if (err) { 4012 pr_err("alg: akcipher: %s test failed. err %d\n", op, err); 4013 goto free_all; 4014 } 4015 if (!vecs->siggen_sigver_test && c) { 4016 if (req->dst_len != c_size) { 4017 pr_err("alg: akcipher: %s test failed. Invalid output len\n", 4018 op); 4019 err = -EINVAL; 4020 goto free_all; 4021 } 4022 /* verify that encrypted message is equal to expected */ 4023 if (memcmp(c, outbuf_enc, c_size) != 0) { 4024 pr_err("alg: akcipher: %s test failed. Invalid output\n", 4025 op); 4026 hexdump(outbuf_enc, c_size); 4027 err = -EINVAL; 4028 goto free_all; 4029 } 4030 } 4031 4032 /* 4033 * Don't invoke (decrypt or sign) test which require a private key 4034 * for vectors with only a public key. 4035 */ 4036 if (vecs->public_key_vec) { 4037 err = 0; 4038 goto free_all; 4039 } 4040 outbuf_dec = kzalloc(out_len_max, GFP_KERNEL); 4041 if (!outbuf_dec) { 4042 err = -ENOMEM; 4043 goto free_all; 4044 } 4045 4046 if (!vecs->siggen_sigver_test && !c) { 4047 c = outbuf_enc; 4048 c_size = req->dst_len; 4049 } 4050 4051 err = -E2BIG; 4052 op = vecs->siggen_sigver_test ? "sign" : "decrypt"; 4053 if (WARN_ON(c_size > PAGE_SIZE)) 4054 goto free_all; 4055 memcpy(xbuf[0], c, c_size); 4056 4057 sg_init_one(&src, xbuf[0], c_size); 4058 sg_init_one(&dst, outbuf_dec, out_len_max); 4059 crypto_init_wait(&wait); 4060 akcipher_request_set_crypt(req, &src, &dst, c_size, out_len_max); 4061 4062 err = crypto_wait_req(vecs->siggen_sigver_test ? 4063 /* Run asymmetric signature generation */ 4064 crypto_akcipher_sign(req) : 4065 /* Run asymmetric decrypt */ 4066 crypto_akcipher_decrypt(req), &wait); 4067 if (err) { 4068 pr_err("alg: akcipher: %s test failed. err %d\n", op, err); 4069 goto free_all; 4070 } 4071 out_len = req->dst_len; 4072 if (out_len < m_size) { 4073 pr_err("alg: akcipher: %s test failed. Invalid output len %u\n", 4074 op, out_len); 4075 err = -EINVAL; 4076 goto free_all; 4077 } 4078 /* verify that decrypted message is equal to the original msg */ 4079 if (memchr_inv(outbuf_dec, 0, out_len - m_size) || 4080 memcmp(m, outbuf_dec + out_len - m_size, m_size)) { 4081 pr_err("alg: akcipher: %s test failed. Invalid output\n", op); 4082 hexdump(outbuf_dec, out_len); 4083 err = -EINVAL; 4084 } 4085 free_all: 4086 kfree(outbuf_dec); 4087 kfree(outbuf_enc); 4088 free_key: 4089 kfree(key); 4090 free_req: 4091 akcipher_request_free(req); 4092 free_xbuf: 4093 testmgr_free_buf(xbuf); 4094 return err; 4095 } 4096 4097 static int test_akcipher(struct crypto_akcipher *tfm, const char *alg, 4098 const struct akcipher_testvec *vecs, 4099 unsigned int tcount) 4100 { 4101 const char *algo = 4102 crypto_tfm_alg_driver_name(crypto_akcipher_tfm(tfm)); 4103 int ret, i; 4104 4105 for (i = 0; i < tcount; i++) { 4106 ret = test_akcipher_one(tfm, vecs++); 4107 if (!ret) 4108 continue; 4109 4110 pr_err("alg: akcipher: test %d failed for %s, err=%d\n", 4111 i + 1, algo, ret); 4112 return ret; 4113 } 4114 return 0; 4115 } 4116 4117 static int alg_test_akcipher(const struct alg_test_desc *desc, 4118 const char *driver, u32 type, u32 mask) 4119 { 4120 struct crypto_akcipher *tfm; 4121 int err = 0; 4122 4123 tfm = crypto_alloc_akcipher(driver, type, mask); 4124 if (IS_ERR(tfm)) { 4125 pr_err("alg: akcipher: Failed to load tfm for %s: %ld\n", 4126 driver, PTR_ERR(tfm)); 4127 return PTR_ERR(tfm); 4128 } 4129 if (desc->suite.akcipher.vecs) 4130 err = test_akcipher(tfm, desc->alg, desc->suite.akcipher.vecs, 4131 desc->suite.akcipher.count); 4132 4133 crypto_free_akcipher(tfm); 4134 return err; 4135 } 4136 4137 static int alg_test_null(const struct alg_test_desc *desc, 4138 const char *driver, u32 type, u32 mask) 4139 { 4140 return 0; 4141 } 4142 4143 #define ____VECS(tv) .vecs = tv, .count = ARRAY_SIZE(tv) 4144 #define __VECS(tv) { ____VECS(tv) } 4145 4146 /* Please keep this list sorted by algorithm name. */ 4147 static const struct alg_test_desc alg_test_descs[] = { 4148 { 4149 .alg = "adiantum(xchacha12,aes)", 4150 .generic_driver = "adiantum(xchacha12-generic,aes-generic,nhpoly1305-generic)", 4151 .test = alg_test_skcipher, 4152 .suite = { 4153 .cipher = __VECS(adiantum_xchacha12_aes_tv_template) 4154 }, 4155 }, { 4156 .alg = "adiantum(xchacha20,aes)", 4157 .generic_driver = "adiantum(xchacha20-generic,aes-generic,nhpoly1305-generic)", 4158 .test = alg_test_skcipher, 4159 .suite = { 4160 .cipher = __VECS(adiantum_xchacha20_aes_tv_template) 4161 }, 4162 }, { 4163 .alg = "aegis128", 4164 .test = alg_test_aead, 4165 .suite = { 4166 .aead = __VECS(aegis128_tv_template) 4167 } 4168 }, { 4169 .alg = "ansi_cprng", 4170 .test = alg_test_cprng, 4171 .suite = { 4172 .cprng = __VECS(ansi_cprng_aes_tv_template) 4173 } 4174 }, { 4175 .alg = "authenc(hmac(md5),ecb(cipher_null))", 4176 .test = alg_test_aead, 4177 .suite = { 4178 .aead = __VECS(hmac_md5_ecb_cipher_null_tv_template) 4179 } 4180 }, { 4181 .alg = "authenc(hmac(sha1),cbc(aes))", 4182 .test = alg_test_aead, 4183 .fips_allowed = 1, 4184 .suite = { 4185 .aead = __VECS(hmac_sha1_aes_cbc_tv_temp) 4186 } 4187 }, { 4188 .alg = "authenc(hmac(sha1),cbc(des))", 4189 .test = alg_test_aead, 4190 .suite = { 4191 .aead = __VECS(hmac_sha1_des_cbc_tv_temp) 4192 } 4193 }, { 4194 .alg = "authenc(hmac(sha1),cbc(des3_ede))", 4195 .test = alg_test_aead, 4196 .suite = { 4197 .aead = __VECS(hmac_sha1_des3_ede_cbc_tv_temp) 4198 } 4199 }, { 4200 .alg = "authenc(hmac(sha1),ctr(aes))", 4201 .test = alg_test_null, 4202 .fips_allowed = 1, 4203 }, { 4204 .alg = "authenc(hmac(sha1),ecb(cipher_null))", 4205 .test = alg_test_aead, 4206 .suite = { 4207 .aead = __VECS(hmac_sha1_ecb_cipher_null_tv_temp) 4208 } 4209 }, { 4210 .alg = "authenc(hmac(sha1),rfc3686(ctr(aes)))", 4211 .test = alg_test_null, 4212 .fips_allowed = 1, 4213 }, { 4214 .alg = "authenc(hmac(sha224),cbc(des))", 4215 .test = alg_test_aead, 4216 .suite = { 4217 .aead = __VECS(hmac_sha224_des_cbc_tv_temp) 4218 } 4219 }, { 4220 .alg = "authenc(hmac(sha224),cbc(des3_ede))", 4221 .test = alg_test_aead, 4222 .suite = { 4223 .aead = __VECS(hmac_sha224_des3_ede_cbc_tv_temp) 4224 } 4225 }, { 4226 .alg = "authenc(hmac(sha256),cbc(aes))", 4227 .test = alg_test_aead, 4228 .fips_allowed = 1, 4229 .suite = { 4230 .aead = __VECS(hmac_sha256_aes_cbc_tv_temp) 4231 } 4232 }, { 4233 .alg = "authenc(hmac(sha256),cbc(des))", 4234 .test = alg_test_aead, 4235 .suite = { 4236 .aead = __VECS(hmac_sha256_des_cbc_tv_temp) 4237 } 4238 }, { 4239 .alg = "authenc(hmac(sha256),cbc(des3_ede))", 4240 .test = alg_test_aead, 4241 .suite = { 4242 .aead = __VECS(hmac_sha256_des3_ede_cbc_tv_temp) 4243 } 4244 }, { 4245 .alg = "authenc(hmac(sha256),ctr(aes))", 4246 .test = alg_test_null, 4247 .fips_allowed = 1, 4248 }, { 4249 .alg = "authenc(hmac(sha256),rfc3686(ctr(aes)))", 4250 .test = alg_test_null, 4251 .fips_allowed = 1, 4252 }, { 4253 .alg = "authenc(hmac(sha384),cbc(des))", 4254 .test = alg_test_aead, 4255 .suite = { 4256 .aead = __VECS(hmac_sha384_des_cbc_tv_temp) 4257 } 4258 }, { 4259 .alg = "authenc(hmac(sha384),cbc(des3_ede))", 4260 .test = alg_test_aead, 4261 .suite = { 4262 .aead = __VECS(hmac_sha384_des3_ede_cbc_tv_temp) 4263 } 4264 }, { 4265 .alg = "authenc(hmac(sha384),ctr(aes))", 4266 .test = alg_test_null, 4267 .fips_allowed = 1, 4268 }, { 4269 .alg = "authenc(hmac(sha384),rfc3686(ctr(aes)))", 4270 .test = alg_test_null, 4271 .fips_allowed = 1, 4272 }, { 4273 .alg = "authenc(hmac(sha512),cbc(aes))", 4274 .fips_allowed = 1, 4275 .test = alg_test_aead, 4276 .suite = { 4277 .aead = __VECS(hmac_sha512_aes_cbc_tv_temp) 4278 } 4279 }, { 4280 .alg = "authenc(hmac(sha512),cbc(des))", 4281 .test = alg_test_aead, 4282 .suite = { 4283 .aead = __VECS(hmac_sha512_des_cbc_tv_temp) 4284 } 4285 }, { 4286 .alg = "authenc(hmac(sha512),cbc(des3_ede))", 4287 .test = alg_test_aead, 4288 .suite = { 4289 .aead = __VECS(hmac_sha512_des3_ede_cbc_tv_temp) 4290 } 4291 }, { 4292 .alg = "authenc(hmac(sha512),ctr(aes))", 4293 .test = alg_test_null, 4294 .fips_allowed = 1, 4295 }, { 4296 .alg = "authenc(hmac(sha512),rfc3686(ctr(aes)))", 4297 .test = alg_test_null, 4298 .fips_allowed = 1, 4299 }, { 4300 .alg = "blake2b-160", 4301 .test = alg_test_hash, 4302 .fips_allowed = 0, 4303 .suite = { 4304 .hash = __VECS(blake2b_160_tv_template) 4305 } 4306 }, { 4307 .alg = "blake2b-256", 4308 .test = alg_test_hash, 4309 .fips_allowed = 0, 4310 .suite = { 4311 .hash = __VECS(blake2b_256_tv_template) 4312 } 4313 }, { 4314 .alg = "blake2b-384", 4315 .test = alg_test_hash, 4316 .fips_allowed = 0, 4317 .suite = { 4318 .hash = __VECS(blake2b_384_tv_template) 4319 } 4320 }, { 4321 .alg = "blake2b-512", 4322 .test = alg_test_hash, 4323 .fips_allowed = 0, 4324 .suite = { 4325 .hash = __VECS(blake2b_512_tv_template) 4326 } 4327 }, { 4328 .alg = "blake2s-128", 4329 .test = alg_test_hash, 4330 .suite = { 4331 .hash = __VECS(blakes2s_128_tv_template) 4332 } 4333 }, { 4334 .alg = "blake2s-160", 4335 .test = alg_test_hash, 4336 .suite = { 4337 .hash = __VECS(blakes2s_160_tv_template) 4338 } 4339 }, { 4340 .alg = "blake2s-224", 4341 .test = alg_test_hash, 4342 .suite = { 4343 .hash = __VECS(blakes2s_224_tv_template) 4344 } 4345 }, { 4346 .alg = "blake2s-256", 4347 .test = alg_test_hash, 4348 .suite = { 4349 .hash = __VECS(blakes2s_256_tv_template) 4350 } 4351 }, { 4352 .alg = "cbc(aes)", 4353 .test = alg_test_skcipher, 4354 .fips_allowed = 1, 4355 .suite = { 4356 .cipher = __VECS(aes_cbc_tv_template) 4357 }, 4358 }, { 4359 .alg = "cbc(anubis)", 4360 .test = alg_test_skcipher, 4361 .suite = { 4362 .cipher = __VECS(anubis_cbc_tv_template) 4363 }, 4364 }, { 4365 .alg = "cbc(blowfish)", 4366 .test = alg_test_skcipher, 4367 .suite = { 4368 .cipher = __VECS(bf_cbc_tv_template) 4369 }, 4370 }, { 4371 .alg = "cbc(camellia)", 4372 .test = alg_test_skcipher, 4373 .suite = { 4374 .cipher = __VECS(camellia_cbc_tv_template) 4375 }, 4376 }, { 4377 .alg = "cbc(cast5)", 4378 .test = alg_test_skcipher, 4379 .suite = { 4380 .cipher = __VECS(cast5_cbc_tv_template) 4381 }, 4382 }, { 4383 .alg = "cbc(cast6)", 4384 .test = alg_test_skcipher, 4385 .suite = { 4386 .cipher = __VECS(cast6_cbc_tv_template) 4387 }, 4388 }, { 4389 .alg = "cbc(des)", 4390 .test = alg_test_skcipher, 4391 .suite = { 4392 .cipher = __VECS(des_cbc_tv_template) 4393 }, 4394 }, { 4395 .alg = "cbc(des3_ede)", 4396 .test = alg_test_skcipher, 4397 .suite = { 4398 .cipher = __VECS(des3_ede_cbc_tv_template) 4399 }, 4400 }, { 4401 /* Same as cbc(aes) except the key is stored in 4402 * hardware secure memory which we reference by index 4403 */ 4404 .alg = "cbc(paes)", 4405 .test = alg_test_null, 4406 .fips_allowed = 1, 4407 }, { 4408 /* Same as cbc(sm4) except the key is stored in 4409 * hardware secure memory which we reference by index 4410 */ 4411 .alg = "cbc(psm4)", 4412 .test = alg_test_null, 4413 }, { 4414 .alg = "cbc(serpent)", 4415 .test = alg_test_skcipher, 4416 .suite = { 4417 .cipher = __VECS(serpent_cbc_tv_template) 4418 }, 4419 }, { 4420 .alg = "cbc(sm4)", 4421 .test = alg_test_skcipher, 4422 .suite = { 4423 .cipher = __VECS(sm4_cbc_tv_template) 4424 } 4425 }, { 4426 .alg = "cbc(twofish)", 4427 .test = alg_test_skcipher, 4428 .suite = { 4429 .cipher = __VECS(tf_cbc_tv_template) 4430 }, 4431 }, { 4432 #if IS_ENABLED(CONFIG_CRYPTO_PAES_S390) 4433 .alg = "cbc-paes-s390", 4434 .fips_allowed = 1, 4435 .test = alg_test_skcipher, 4436 .suite = { 4437 .cipher = __VECS(aes_cbc_tv_template) 4438 } 4439 }, { 4440 #endif 4441 .alg = "cbcmac(aes)", 4442 .fips_allowed = 1, 4443 .test = alg_test_hash, 4444 .suite = { 4445 .hash = __VECS(aes_cbcmac_tv_template) 4446 } 4447 }, { 4448 .alg = "cbcmac(sm4)", 4449 .test = alg_test_hash, 4450 .suite = { 4451 .hash = __VECS(sm4_cbcmac_tv_template) 4452 } 4453 }, { 4454 .alg = "ccm(aes)", 4455 .generic_driver = "ccm_base(ctr(aes-generic),cbcmac(aes-generic))", 4456 .test = alg_test_aead, 4457 .fips_allowed = 1, 4458 .suite = { 4459 .aead = { 4460 ____VECS(aes_ccm_tv_template), 4461 .einval_allowed = 1, 4462 } 4463 } 4464 }, { 4465 .alg = "ccm(sm4)", 4466 .generic_driver = "ccm_base(ctr(sm4-generic),cbcmac(sm4-generic))", 4467 .test = alg_test_aead, 4468 .suite = { 4469 .aead = { 4470 ____VECS(sm4_ccm_tv_template), 4471 .einval_allowed = 1, 4472 } 4473 } 4474 }, { 4475 .alg = "cfb(aes)", 4476 .test = alg_test_skcipher, 4477 .fips_allowed = 1, 4478 .suite = { 4479 .cipher = __VECS(aes_cfb_tv_template) 4480 }, 4481 }, { 4482 .alg = "cfb(sm4)", 4483 .test = alg_test_skcipher, 4484 .suite = { 4485 .cipher = __VECS(sm4_cfb_tv_template) 4486 } 4487 }, { 4488 .alg = "chacha20", 4489 .test = alg_test_skcipher, 4490 .suite = { 4491 .cipher = __VECS(chacha20_tv_template) 4492 }, 4493 }, { 4494 .alg = "cmac(aes)", 4495 .fips_allowed = 1, 4496 .test = alg_test_hash, 4497 .suite = { 4498 .hash = __VECS(aes_cmac128_tv_template) 4499 } 4500 }, { 4501 .alg = "cmac(des3_ede)", 4502 .test = alg_test_hash, 4503 .suite = { 4504 .hash = __VECS(des3_ede_cmac64_tv_template) 4505 } 4506 }, { 4507 .alg = "cmac(sm4)", 4508 .test = alg_test_hash, 4509 .suite = { 4510 .hash = __VECS(sm4_cmac128_tv_template) 4511 } 4512 }, { 4513 .alg = "compress_null", 4514 .test = alg_test_null, 4515 }, { 4516 .alg = "crc32", 4517 .test = alg_test_hash, 4518 .fips_allowed = 1, 4519 .suite = { 4520 .hash = __VECS(crc32_tv_template) 4521 } 4522 }, { 4523 .alg = "crc32c", 4524 .test = alg_test_crc32c, 4525 .fips_allowed = 1, 4526 .suite = { 4527 .hash = __VECS(crc32c_tv_template) 4528 } 4529 }, { 4530 .alg = "crct10dif", 4531 .test = alg_test_hash, 4532 .fips_allowed = 1, 4533 .suite = { 4534 .hash = __VECS(crct10dif_tv_template) 4535 } 4536 }, { 4537 .alg = "ctr(aes)", 4538 .test = alg_test_skcipher, 4539 .fips_allowed = 1, 4540 .suite = { 4541 .cipher = __VECS(aes_ctr_tv_template) 4542 } 4543 }, { 4544 .alg = "ctr(blowfish)", 4545 .test = alg_test_skcipher, 4546 .suite = { 4547 .cipher = __VECS(bf_ctr_tv_template) 4548 } 4549 }, { 4550 .alg = "ctr(camellia)", 4551 .test = alg_test_skcipher, 4552 .suite = { 4553 .cipher = __VECS(camellia_ctr_tv_template) 4554 } 4555 }, { 4556 .alg = "ctr(cast5)", 4557 .test = alg_test_skcipher, 4558 .suite = { 4559 .cipher = __VECS(cast5_ctr_tv_template) 4560 } 4561 }, { 4562 .alg = "ctr(cast6)", 4563 .test = alg_test_skcipher, 4564 .suite = { 4565 .cipher = __VECS(cast6_ctr_tv_template) 4566 } 4567 }, { 4568 .alg = "ctr(des)", 4569 .test = alg_test_skcipher, 4570 .suite = { 4571 .cipher = __VECS(des_ctr_tv_template) 4572 } 4573 }, { 4574 .alg = "ctr(des3_ede)", 4575 .test = alg_test_skcipher, 4576 .suite = { 4577 .cipher = __VECS(des3_ede_ctr_tv_template) 4578 } 4579 }, { 4580 /* Same as ctr(aes) except the key is stored in 4581 * hardware secure memory which we reference by index 4582 */ 4583 .alg = "ctr(paes)", 4584 .test = alg_test_null, 4585 .fips_allowed = 1, 4586 }, { 4587 4588 /* Same as ctr(sm4) except the key is stored in 4589 * hardware secure memory which we reference by index 4590 */ 4591 .alg = "ctr(psm4)", 4592 .test = alg_test_null, 4593 }, { 4594 .alg = "ctr(serpent)", 4595 .test = alg_test_skcipher, 4596 .suite = { 4597 .cipher = __VECS(serpent_ctr_tv_template) 4598 } 4599 }, { 4600 .alg = "ctr(sm4)", 4601 .test = alg_test_skcipher, 4602 .suite = { 4603 .cipher = __VECS(sm4_ctr_tv_template) 4604 } 4605 }, { 4606 .alg = "ctr(twofish)", 4607 .test = alg_test_skcipher, 4608 .suite = { 4609 .cipher = __VECS(tf_ctr_tv_template) 4610 } 4611 }, { 4612 #if IS_ENABLED(CONFIG_CRYPTO_PAES_S390) 4613 .alg = "ctr-paes-s390", 4614 .fips_allowed = 1, 4615 .test = alg_test_skcipher, 4616 .suite = { 4617 .cipher = __VECS(aes_ctr_tv_template) 4618 } 4619 }, { 4620 #endif 4621 .alg = "cts(cbc(aes))", 4622 .test = alg_test_skcipher, 4623 .fips_allowed = 1, 4624 .suite = { 4625 .cipher = __VECS(cts_mode_tv_template) 4626 } 4627 }, { 4628 /* Same as cts(cbc((aes)) except the key is stored in 4629 * hardware secure memory which we reference by index 4630 */ 4631 .alg = "cts(cbc(paes))", 4632 .test = alg_test_null, 4633 .fips_allowed = 1, 4634 }, { 4635 .alg = "curve25519", 4636 .test = alg_test_kpp, 4637 .suite = { 4638 .kpp = __VECS(curve25519_tv_template) 4639 } 4640 }, { 4641 .alg = "deflate", 4642 .test = alg_test_comp, 4643 .fips_allowed = 1, 4644 .suite = { 4645 .comp = { 4646 .comp = __VECS(deflate_comp_tv_template), 4647 .decomp = __VECS(deflate_decomp_tv_template) 4648 } 4649 } 4650 }, { 4651 .alg = "dh", 4652 .test = alg_test_kpp, 4653 .fips_allowed = 1, 4654 .suite = { 4655 .kpp = __VECS(dh_tv_template) 4656 } 4657 }, { 4658 .alg = "digest_null", 4659 .test = alg_test_null, 4660 }, { 4661 .alg = "drbg_nopr_ctr_aes128", 4662 .test = alg_test_drbg, 4663 .fips_allowed = 1, 4664 .suite = { 4665 .drbg = __VECS(drbg_nopr_ctr_aes128_tv_template) 4666 } 4667 }, { 4668 .alg = "drbg_nopr_ctr_aes192", 4669 .test = alg_test_drbg, 4670 .fips_allowed = 1, 4671 .suite = { 4672 .drbg = __VECS(drbg_nopr_ctr_aes192_tv_template) 4673 } 4674 }, { 4675 .alg = "drbg_nopr_ctr_aes256", 4676 .test = alg_test_drbg, 4677 .fips_allowed = 1, 4678 .suite = { 4679 .drbg = __VECS(drbg_nopr_ctr_aes256_tv_template) 4680 } 4681 }, { 4682 /* 4683 * There is no need to specifically test the DRBG with every 4684 * backend cipher -- covered by drbg_nopr_hmac_sha256 test 4685 */ 4686 .alg = "drbg_nopr_hmac_sha1", 4687 .fips_allowed = 1, 4688 .test = alg_test_null, 4689 }, { 4690 .alg = "drbg_nopr_hmac_sha256", 4691 .test = alg_test_drbg, 4692 .fips_allowed = 1, 4693 .suite = { 4694 .drbg = __VECS(drbg_nopr_hmac_sha256_tv_template) 4695 } 4696 }, { 4697 /* covered by drbg_nopr_hmac_sha256 test */ 4698 .alg = "drbg_nopr_hmac_sha384", 4699 .fips_allowed = 1, 4700 .test = alg_test_null, 4701 }, { 4702 .alg = "drbg_nopr_hmac_sha512", 4703 .test = alg_test_drbg, 4704 .fips_allowed = 1, 4705 .suite = { 4706 .drbg = __VECS(drbg_nopr_hmac_sha512_tv_template) 4707 } 4708 }, { 4709 .alg = "drbg_nopr_sha1", 4710 .fips_allowed = 1, 4711 .test = alg_test_null, 4712 }, { 4713 .alg = "drbg_nopr_sha256", 4714 .test = alg_test_drbg, 4715 .fips_allowed = 1, 4716 .suite = { 4717 .drbg = __VECS(drbg_nopr_sha256_tv_template) 4718 } 4719 }, { 4720 /* covered by drbg_nopr_sha256 test */ 4721 .alg = "drbg_nopr_sha384", 4722 .fips_allowed = 1, 4723 .test = alg_test_null, 4724 }, { 4725 .alg = "drbg_nopr_sha512", 4726 .fips_allowed = 1, 4727 .test = alg_test_null, 4728 }, { 4729 .alg = "drbg_pr_ctr_aes128", 4730 .test = alg_test_drbg, 4731 .fips_allowed = 1, 4732 .suite = { 4733 .drbg = __VECS(drbg_pr_ctr_aes128_tv_template) 4734 } 4735 }, { 4736 /* covered by drbg_pr_ctr_aes128 test */ 4737 .alg = "drbg_pr_ctr_aes192", 4738 .fips_allowed = 1, 4739 .test = alg_test_null, 4740 }, { 4741 .alg = "drbg_pr_ctr_aes256", 4742 .fips_allowed = 1, 4743 .test = alg_test_null, 4744 }, { 4745 .alg = "drbg_pr_hmac_sha1", 4746 .fips_allowed = 1, 4747 .test = alg_test_null, 4748 }, { 4749 .alg = "drbg_pr_hmac_sha256", 4750 .test = alg_test_drbg, 4751 .fips_allowed = 1, 4752 .suite = { 4753 .drbg = __VECS(drbg_pr_hmac_sha256_tv_template) 4754 } 4755 }, { 4756 /* covered by drbg_pr_hmac_sha256 test */ 4757 .alg = "drbg_pr_hmac_sha384", 4758 .fips_allowed = 1, 4759 .test = alg_test_null, 4760 }, { 4761 .alg = "drbg_pr_hmac_sha512", 4762 .test = alg_test_null, 4763 .fips_allowed = 1, 4764 }, { 4765 .alg = "drbg_pr_sha1", 4766 .fips_allowed = 1, 4767 .test = alg_test_null, 4768 }, { 4769 .alg = "drbg_pr_sha256", 4770 .test = alg_test_drbg, 4771 .fips_allowed = 1, 4772 .suite = { 4773 .drbg = __VECS(drbg_pr_sha256_tv_template) 4774 } 4775 }, { 4776 /* covered by drbg_pr_sha256 test */ 4777 .alg = "drbg_pr_sha384", 4778 .fips_allowed = 1, 4779 .test = alg_test_null, 4780 }, { 4781 .alg = "drbg_pr_sha512", 4782 .fips_allowed = 1, 4783 .test = alg_test_null, 4784 }, { 4785 .alg = "ecb(aes)", 4786 .test = alg_test_skcipher, 4787 .fips_allowed = 1, 4788 .suite = { 4789 .cipher = __VECS(aes_tv_template) 4790 } 4791 }, { 4792 .alg = "ecb(anubis)", 4793 .test = alg_test_skcipher, 4794 .suite = { 4795 .cipher = __VECS(anubis_tv_template) 4796 } 4797 }, { 4798 .alg = "ecb(arc4)", 4799 .generic_driver = "ecb(arc4)-generic", 4800 .test = alg_test_skcipher, 4801 .suite = { 4802 .cipher = __VECS(arc4_tv_template) 4803 } 4804 }, { 4805 .alg = "ecb(blowfish)", 4806 .test = alg_test_skcipher, 4807 .suite = { 4808 .cipher = __VECS(bf_tv_template) 4809 } 4810 }, { 4811 .alg = "ecb(camellia)", 4812 .test = alg_test_skcipher, 4813 .suite = { 4814 .cipher = __VECS(camellia_tv_template) 4815 } 4816 }, { 4817 .alg = "ecb(cast5)", 4818 .test = alg_test_skcipher, 4819 .suite = { 4820 .cipher = __VECS(cast5_tv_template) 4821 } 4822 }, { 4823 .alg = "ecb(cast6)", 4824 .test = alg_test_skcipher, 4825 .suite = { 4826 .cipher = __VECS(cast6_tv_template) 4827 } 4828 }, { 4829 .alg = "ecb(cipher_null)", 4830 .test = alg_test_null, 4831 .fips_allowed = 1, 4832 }, { 4833 .alg = "ecb(des)", 4834 .test = alg_test_skcipher, 4835 .suite = { 4836 .cipher = __VECS(des_tv_template) 4837 } 4838 }, { 4839 .alg = "ecb(des3_ede)", 4840 .test = alg_test_skcipher, 4841 .suite = { 4842 .cipher = __VECS(des3_ede_tv_template) 4843 } 4844 }, { 4845 .alg = "ecb(fcrypt)", 4846 .test = alg_test_skcipher, 4847 .suite = { 4848 .cipher = { 4849 .vecs = fcrypt_pcbc_tv_template, 4850 .count = 1 4851 } 4852 } 4853 }, { 4854 .alg = "ecb(khazad)", 4855 .test = alg_test_skcipher, 4856 .suite = { 4857 .cipher = __VECS(khazad_tv_template) 4858 } 4859 }, { 4860 /* Same as ecb(aes) except the key is stored in 4861 * hardware secure memory which we reference by index 4862 */ 4863 .alg = "ecb(paes)", 4864 .test = alg_test_null, 4865 .fips_allowed = 1, 4866 }, { 4867 .alg = "ecb(seed)", 4868 .test = alg_test_skcipher, 4869 .suite = { 4870 .cipher = __VECS(seed_tv_template) 4871 } 4872 }, { 4873 .alg = "ecb(serpent)", 4874 .test = alg_test_skcipher, 4875 .suite = { 4876 .cipher = __VECS(serpent_tv_template) 4877 } 4878 }, { 4879 .alg = "ecb(sm4)", 4880 .test = alg_test_skcipher, 4881 .suite = { 4882 .cipher = __VECS(sm4_tv_template) 4883 } 4884 }, { 4885 .alg = "ecb(tea)", 4886 .test = alg_test_skcipher, 4887 .suite = { 4888 .cipher = __VECS(tea_tv_template) 4889 } 4890 }, { 4891 .alg = "ecb(twofish)", 4892 .test = alg_test_skcipher, 4893 .suite = { 4894 .cipher = __VECS(tf_tv_template) 4895 } 4896 }, { 4897 .alg = "ecb(xeta)", 4898 .test = alg_test_skcipher, 4899 .suite = { 4900 .cipher = __VECS(xeta_tv_template) 4901 } 4902 }, { 4903 .alg = "ecb(xtea)", 4904 .test = alg_test_skcipher, 4905 .suite = { 4906 .cipher = __VECS(xtea_tv_template) 4907 } 4908 }, { 4909 #if IS_ENABLED(CONFIG_CRYPTO_PAES_S390) 4910 .alg = "ecb-paes-s390", 4911 .fips_allowed = 1, 4912 .test = alg_test_skcipher, 4913 .suite = { 4914 .cipher = __VECS(aes_tv_template) 4915 } 4916 }, { 4917 #endif 4918 .alg = "ecdh-nist-p192", 4919 .test = alg_test_kpp, 4920 .suite = { 4921 .kpp = __VECS(ecdh_p192_tv_template) 4922 } 4923 }, { 4924 .alg = "ecdh-nist-p256", 4925 .test = alg_test_kpp, 4926 .fips_allowed = 1, 4927 .suite = { 4928 .kpp = __VECS(ecdh_p256_tv_template) 4929 } 4930 }, { 4931 .alg = "ecdh-nist-p384", 4932 .test = alg_test_kpp, 4933 .fips_allowed = 1, 4934 .suite = { 4935 .kpp = __VECS(ecdh_p384_tv_template) 4936 } 4937 }, { 4938 .alg = "ecdsa-nist-p192", 4939 .test = alg_test_akcipher, 4940 .suite = { 4941 .akcipher = __VECS(ecdsa_nist_p192_tv_template) 4942 } 4943 }, { 4944 .alg = "ecdsa-nist-p256", 4945 .test = alg_test_akcipher, 4946 .suite = { 4947 .akcipher = __VECS(ecdsa_nist_p256_tv_template) 4948 } 4949 }, { 4950 .alg = "ecdsa-nist-p384", 4951 .test = alg_test_akcipher, 4952 .suite = { 4953 .akcipher = __VECS(ecdsa_nist_p384_tv_template) 4954 } 4955 }, { 4956 .alg = "ecrdsa", 4957 .test = alg_test_akcipher, 4958 .suite = { 4959 .akcipher = __VECS(ecrdsa_tv_template) 4960 } 4961 }, { 4962 .alg = "essiv(authenc(hmac(sha256),cbc(aes)),sha256)", 4963 .test = alg_test_aead, 4964 .fips_allowed = 1, 4965 .suite = { 4966 .aead = __VECS(essiv_hmac_sha256_aes_cbc_tv_temp) 4967 } 4968 }, { 4969 .alg = "essiv(cbc(aes),sha256)", 4970 .test = alg_test_skcipher, 4971 .fips_allowed = 1, 4972 .suite = { 4973 .cipher = __VECS(essiv_aes_cbc_tv_template) 4974 } 4975 }, { 4976 .alg = "gcm(aes)", 4977 .generic_driver = "gcm_base(ctr(aes-generic),ghash-generic)", 4978 .test = alg_test_aead, 4979 .fips_allowed = 1, 4980 .suite = { 4981 .aead = __VECS(aes_gcm_tv_template) 4982 } 4983 }, { 4984 .alg = "gcm(sm4)", 4985 .generic_driver = "gcm_base(ctr(sm4-generic),ghash-generic)", 4986 .test = alg_test_aead, 4987 .suite = { 4988 .aead = __VECS(sm4_gcm_tv_template) 4989 } 4990 }, { 4991 .alg = "ghash", 4992 .test = alg_test_hash, 4993 .fips_allowed = 1, 4994 .suite = { 4995 .hash = __VECS(ghash_tv_template) 4996 } 4997 }, { 4998 .alg = "hmac(md5)", 4999 .test = alg_test_hash, 5000 .suite = { 5001 .hash = __VECS(hmac_md5_tv_template) 5002 } 5003 }, { 5004 .alg = "hmac(rmd160)", 5005 .test = alg_test_hash, 5006 .suite = { 5007 .hash = __VECS(hmac_rmd160_tv_template) 5008 } 5009 }, { 5010 .alg = "hmac(sha1)", 5011 .test = alg_test_hash, 5012 .fips_allowed = 1, 5013 .suite = { 5014 .hash = __VECS(hmac_sha1_tv_template) 5015 } 5016 }, { 5017 .alg = "hmac(sha224)", 5018 .test = alg_test_hash, 5019 .fips_allowed = 1, 5020 .suite = { 5021 .hash = __VECS(hmac_sha224_tv_template) 5022 } 5023 }, { 5024 .alg = "hmac(sha256)", 5025 .test = alg_test_hash, 5026 .fips_allowed = 1, 5027 .suite = { 5028 .hash = __VECS(hmac_sha256_tv_template) 5029 } 5030 }, { 5031 .alg = "hmac(sha3-224)", 5032 .test = alg_test_hash, 5033 .fips_allowed = 1, 5034 .suite = { 5035 .hash = __VECS(hmac_sha3_224_tv_template) 5036 } 5037 }, { 5038 .alg = "hmac(sha3-256)", 5039 .test = alg_test_hash, 5040 .fips_allowed = 1, 5041 .suite = { 5042 .hash = __VECS(hmac_sha3_256_tv_template) 5043 } 5044 }, { 5045 .alg = "hmac(sha3-384)", 5046 .test = alg_test_hash, 5047 .fips_allowed = 1, 5048 .suite = { 5049 .hash = __VECS(hmac_sha3_384_tv_template) 5050 } 5051 }, { 5052 .alg = "hmac(sha3-512)", 5053 .test = alg_test_hash, 5054 .fips_allowed = 1, 5055 .suite = { 5056 .hash = __VECS(hmac_sha3_512_tv_template) 5057 } 5058 }, { 5059 .alg = "hmac(sha384)", 5060 .test = alg_test_hash, 5061 .fips_allowed = 1, 5062 .suite = { 5063 .hash = __VECS(hmac_sha384_tv_template) 5064 } 5065 }, { 5066 .alg = "hmac(sha512)", 5067 .test = alg_test_hash, 5068 .fips_allowed = 1, 5069 .suite = { 5070 .hash = __VECS(hmac_sha512_tv_template) 5071 } 5072 }, { 5073 .alg = "hmac(sm3)", 5074 .test = alg_test_hash, 5075 .suite = { 5076 .hash = __VECS(hmac_sm3_tv_template) 5077 } 5078 }, { 5079 .alg = "hmac(streebog256)", 5080 .test = alg_test_hash, 5081 .suite = { 5082 .hash = __VECS(hmac_streebog256_tv_template) 5083 } 5084 }, { 5085 .alg = "hmac(streebog512)", 5086 .test = alg_test_hash, 5087 .suite = { 5088 .hash = __VECS(hmac_streebog512_tv_template) 5089 } 5090 }, { 5091 .alg = "jitterentropy_rng", 5092 .fips_allowed = 1, 5093 .test = alg_test_null, 5094 }, { 5095 .alg = "kw(aes)", 5096 .test = alg_test_skcipher, 5097 .fips_allowed = 1, 5098 .suite = { 5099 .cipher = __VECS(aes_kw_tv_template) 5100 } 5101 }, { 5102 .alg = "lrw(aes)", 5103 .generic_driver = "lrw(ecb(aes-generic))", 5104 .test = alg_test_skcipher, 5105 .suite = { 5106 .cipher = __VECS(aes_lrw_tv_template) 5107 } 5108 }, { 5109 .alg = "lrw(camellia)", 5110 .generic_driver = "lrw(ecb(camellia-generic))", 5111 .test = alg_test_skcipher, 5112 .suite = { 5113 .cipher = __VECS(camellia_lrw_tv_template) 5114 } 5115 }, { 5116 .alg = "lrw(cast6)", 5117 .generic_driver = "lrw(ecb(cast6-generic))", 5118 .test = alg_test_skcipher, 5119 .suite = { 5120 .cipher = __VECS(cast6_lrw_tv_template) 5121 } 5122 }, { 5123 .alg = "lrw(serpent)", 5124 .generic_driver = "lrw(ecb(serpent-generic))", 5125 .test = alg_test_skcipher, 5126 .suite = { 5127 .cipher = __VECS(serpent_lrw_tv_template) 5128 } 5129 }, { 5130 .alg = "lrw(twofish)", 5131 .generic_driver = "lrw(ecb(twofish-generic))", 5132 .test = alg_test_skcipher, 5133 .suite = { 5134 .cipher = __VECS(tf_lrw_tv_template) 5135 } 5136 }, { 5137 .alg = "lz4", 5138 .test = alg_test_comp, 5139 .fips_allowed = 1, 5140 .suite = { 5141 .comp = { 5142 .comp = __VECS(lz4_comp_tv_template), 5143 .decomp = __VECS(lz4_decomp_tv_template) 5144 } 5145 } 5146 }, { 5147 .alg = "lz4hc", 5148 .test = alg_test_comp, 5149 .fips_allowed = 1, 5150 .suite = { 5151 .comp = { 5152 .comp = __VECS(lz4hc_comp_tv_template), 5153 .decomp = __VECS(lz4hc_decomp_tv_template) 5154 } 5155 } 5156 }, { 5157 .alg = "lzo", 5158 .test = alg_test_comp, 5159 .fips_allowed = 1, 5160 .suite = { 5161 .comp = { 5162 .comp = __VECS(lzo_comp_tv_template), 5163 .decomp = __VECS(lzo_decomp_tv_template) 5164 } 5165 } 5166 }, { 5167 .alg = "lzo-rle", 5168 .test = alg_test_comp, 5169 .fips_allowed = 1, 5170 .suite = { 5171 .comp = { 5172 .comp = __VECS(lzorle_comp_tv_template), 5173 .decomp = __VECS(lzorle_decomp_tv_template) 5174 } 5175 } 5176 }, { 5177 .alg = "md4", 5178 .test = alg_test_hash, 5179 .suite = { 5180 .hash = __VECS(md4_tv_template) 5181 } 5182 }, { 5183 .alg = "md5", 5184 .test = alg_test_hash, 5185 .suite = { 5186 .hash = __VECS(md5_tv_template) 5187 } 5188 }, { 5189 .alg = "michael_mic", 5190 .test = alg_test_hash, 5191 .suite = { 5192 .hash = __VECS(michael_mic_tv_template) 5193 } 5194 }, { 5195 .alg = "nhpoly1305", 5196 .test = alg_test_hash, 5197 .suite = { 5198 .hash = __VECS(nhpoly1305_tv_template) 5199 } 5200 }, { 5201 .alg = "ofb(aes)", 5202 .test = alg_test_skcipher, 5203 .fips_allowed = 1, 5204 .suite = { 5205 .cipher = __VECS(aes_ofb_tv_template) 5206 } 5207 }, { 5208 /* Same as ofb(aes) except the key is stored in 5209 * hardware secure memory which we reference by index 5210 */ 5211 .alg = "ofb(paes)", 5212 .test = alg_test_null, 5213 .fips_allowed = 1, 5214 }, { 5215 .alg = "ofb(sm4)", 5216 .test = alg_test_skcipher, 5217 .suite = { 5218 .cipher = __VECS(sm4_ofb_tv_template) 5219 } 5220 }, { 5221 .alg = "pcbc(fcrypt)", 5222 .test = alg_test_skcipher, 5223 .suite = { 5224 .cipher = __VECS(fcrypt_pcbc_tv_template) 5225 } 5226 }, { 5227 .alg = "pkcs1pad(rsa,sha224)", 5228 .test = alg_test_null, 5229 .fips_allowed = 1, 5230 }, { 5231 .alg = "pkcs1pad(rsa,sha256)", 5232 .test = alg_test_akcipher, 5233 .fips_allowed = 1, 5234 .suite = { 5235 .akcipher = __VECS(pkcs1pad_rsa_tv_template) 5236 } 5237 }, { 5238 .alg = "pkcs1pad(rsa,sha384)", 5239 .test = alg_test_null, 5240 .fips_allowed = 1, 5241 }, { 5242 .alg = "pkcs1pad(rsa,sha512)", 5243 .test = alg_test_null, 5244 .fips_allowed = 1, 5245 }, { 5246 .alg = "poly1305", 5247 .test = alg_test_hash, 5248 .suite = { 5249 .hash = __VECS(poly1305_tv_template) 5250 } 5251 }, { 5252 .alg = "rfc3686(ctr(aes))", 5253 .test = alg_test_skcipher, 5254 .fips_allowed = 1, 5255 .suite = { 5256 .cipher = __VECS(aes_ctr_rfc3686_tv_template) 5257 } 5258 }, { 5259 .alg = "rfc3686(ctr(sm4))", 5260 .test = alg_test_skcipher, 5261 .suite = { 5262 .cipher = __VECS(sm4_ctr_rfc3686_tv_template) 5263 } 5264 }, { 5265 .alg = "rfc4106(gcm(aes))", 5266 .generic_driver = "rfc4106(gcm_base(ctr(aes-generic),ghash-generic))", 5267 .test = alg_test_aead, 5268 .fips_allowed = 1, 5269 .suite = { 5270 .aead = { 5271 ____VECS(aes_gcm_rfc4106_tv_template), 5272 .einval_allowed = 1, 5273 .aad_iv = 1, 5274 } 5275 } 5276 }, { 5277 .alg = "rfc4309(ccm(aes))", 5278 .generic_driver = "rfc4309(ccm_base(ctr(aes-generic),cbcmac(aes-generic)))", 5279 .test = alg_test_aead, 5280 .fips_allowed = 1, 5281 .suite = { 5282 .aead = { 5283 ____VECS(aes_ccm_rfc4309_tv_template), 5284 .einval_allowed = 1, 5285 .aad_iv = 1, 5286 } 5287 } 5288 }, { 5289 .alg = "rfc4543(gcm(aes))", 5290 .generic_driver = "rfc4543(gcm_base(ctr(aes-generic),ghash-generic))", 5291 .test = alg_test_aead, 5292 .suite = { 5293 .aead = { 5294 ____VECS(aes_gcm_rfc4543_tv_template), 5295 .einval_allowed = 1, 5296 .aad_iv = 1, 5297 } 5298 } 5299 }, { 5300 .alg = "rfc7539(chacha20,poly1305)", 5301 .test = alg_test_aead, 5302 .suite = { 5303 .aead = __VECS(rfc7539_tv_template) 5304 } 5305 }, { 5306 .alg = "rfc7539esp(chacha20,poly1305)", 5307 .test = alg_test_aead, 5308 .suite = { 5309 .aead = { 5310 ____VECS(rfc7539esp_tv_template), 5311 .einval_allowed = 1, 5312 .aad_iv = 1, 5313 } 5314 } 5315 }, { 5316 .alg = "rmd160", 5317 .test = alg_test_hash, 5318 .suite = { 5319 .hash = __VECS(rmd160_tv_template) 5320 } 5321 }, { 5322 .alg = "rsa", 5323 .test = alg_test_akcipher, 5324 .fips_allowed = 1, 5325 .suite = { 5326 .akcipher = __VECS(rsa_tv_template) 5327 } 5328 }, { 5329 .alg = "sha1", 5330 .test = alg_test_hash, 5331 .fips_allowed = 1, 5332 .suite = { 5333 .hash = __VECS(sha1_tv_template) 5334 } 5335 }, { 5336 .alg = "sha224", 5337 .test = alg_test_hash, 5338 .fips_allowed = 1, 5339 .suite = { 5340 .hash = __VECS(sha224_tv_template) 5341 } 5342 }, { 5343 .alg = "sha256", 5344 .test = alg_test_hash, 5345 .fips_allowed = 1, 5346 .suite = { 5347 .hash = __VECS(sha256_tv_template) 5348 } 5349 }, { 5350 .alg = "sha3-224", 5351 .test = alg_test_hash, 5352 .fips_allowed = 1, 5353 .suite = { 5354 .hash = __VECS(sha3_224_tv_template) 5355 } 5356 }, { 5357 .alg = "sha3-256", 5358 .test = alg_test_hash, 5359 .fips_allowed = 1, 5360 .suite = { 5361 .hash = __VECS(sha3_256_tv_template) 5362 } 5363 }, { 5364 .alg = "sha3-384", 5365 .test = alg_test_hash, 5366 .fips_allowed = 1, 5367 .suite = { 5368 .hash = __VECS(sha3_384_tv_template) 5369 } 5370 }, { 5371 .alg = "sha3-512", 5372 .test = alg_test_hash, 5373 .fips_allowed = 1, 5374 .suite = { 5375 .hash = __VECS(sha3_512_tv_template) 5376 } 5377 }, { 5378 .alg = "sha384", 5379 .test = alg_test_hash, 5380 .fips_allowed = 1, 5381 .suite = { 5382 .hash = __VECS(sha384_tv_template) 5383 } 5384 }, { 5385 .alg = "sha512", 5386 .test = alg_test_hash, 5387 .fips_allowed = 1, 5388 .suite = { 5389 .hash = __VECS(sha512_tv_template) 5390 } 5391 }, { 5392 .alg = "sm2", 5393 .test = alg_test_akcipher, 5394 .suite = { 5395 .akcipher = __VECS(sm2_tv_template) 5396 } 5397 }, { 5398 .alg = "sm3", 5399 .test = alg_test_hash, 5400 .suite = { 5401 .hash = __VECS(sm3_tv_template) 5402 } 5403 }, { 5404 .alg = "streebog256", 5405 .test = alg_test_hash, 5406 .suite = { 5407 .hash = __VECS(streebog256_tv_template) 5408 } 5409 }, { 5410 .alg = "streebog512", 5411 .test = alg_test_hash, 5412 .suite = { 5413 .hash = __VECS(streebog512_tv_template) 5414 } 5415 }, { 5416 .alg = "vmac64(aes)", 5417 .test = alg_test_hash, 5418 .suite = { 5419 .hash = __VECS(vmac64_aes_tv_template) 5420 } 5421 }, { 5422 .alg = "wp256", 5423 .test = alg_test_hash, 5424 .suite = { 5425 .hash = __VECS(wp256_tv_template) 5426 } 5427 }, { 5428 .alg = "wp384", 5429 .test = alg_test_hash, 5430 .suite = { 5431 .hash = __VECS(wp384_tv_template) 5432 } 5433 }, { 5434 .alg = "wp512", 5435 .test = alg_test_hash, 5436 .suite = { 5437 .hash = __VECS(wp512_tv_template) 5438 } 5439 }, { 5440 .alg = "xcbc(aes)", 5441 .test = alg_test_hash, 5442 .suite = { 5443 .hash = __VECS(aes_xcbc128_tv_template) 5444 } 5445 }, { 5446 .alg = "xchacha12", 5447 .test = alg_test_skcipher, 5448 .suite = { 5449 .cipher = __VECS(xchacha12_tv_template) 5450 }, 5451 }, { 5452 .alg = "xchacha20", 5453 .test = alg_test_skcipher, 5454 .suite = { 5455 .cipher = __VECS(xchacha20_tv_template) 5456 }, 5457 }, { 5458 .alg = "xts(aes)", 5459 .generic_driver = "xts(ecb(aes-generic))", 5460 .test = alg_test_skcipher, 5461 .fips_allowed = 1, 5462 .suite = { 5463 .cipher = __VECS(aes_xts_tv_template) 5464 } 5465 }, { 5466 .alg = "xts(camellia)", 5467 .generic_driver = "xts(ecb(camellia-generic))", 5468 .test = alg_test_skcipher, 5469 .suite = { 5470 .cipher = __VECS(camellia_xts_tv_template) 5471 } 5472 }, { 5473 .alg = "xts(cast6)", 5474 .generic_driver = "xts(ecb(cast6-generic))", 5475 .test = alg_test_skcipher, 5476 .suite = { 5477 .cipher = __VECS(cast6_xts_tv_template) 5478 } 5479 }, { 5480 /* Same as xts(aes) except the key is stored in 5481 * hardware secure memory which we reference by index 5482 */ 5483 .alg = "xts(paes)", 5484 .test = alg_test_null, 5485 .fips_allowed = 1, 5486 }, { 5487 .alg = "xts(serpent)", 5488 .generic_driver = "xts(ecb(serpent-generic))", 5489 .test = alg_test_skcipher, 5490 .suite = { 5491 .cipher = __VECS(serpent_xts_tv_template) 5492 } 5493 }, { 5494 .alg = "xts(twofish)", 5495 .generic_driver = "xts(ecb(twofish-generic))", 5496 .test = alg_test_skcipher, 5497 .suite = { 5498 .cipher = __VECS(tf_xts_tv_template) 5499 } 5500 }, { 5501 #if IS_ENABLED(CONFIG_CRYPTO_PAES_S390) 5502 .alg = "xts-paes-s390", 5503 .fips_allowed = 1, 5504 .test = alg_test_skcipher, 5505 .suite = { 5506 .cipher = __VECS(aes_xts_tv_template) 5507 } 5508 }, { 5509 #endif 5510 .alg = "xts4096(paes)", 5511 .test = alg_test_null, 5512 .fips_allowed = 1, 5513 }, { 5514 .alg = "xts512(paes)", 5515 .test = alg_test_null, 5516 .fips_allowed = 1, 5517 }, { 5518 .alg = "xxhash64", 5519 .test = alg_test_hash, 5520 .fips_allowed = 1, 5521 .suite = { 5522 .hash = __VECS(xxhash64_tv_template) 5523 } 5524 }, { 5525 .alg = "zlib-deflate", 5526 .test = alg_test_comp, 5527 .fips_allowed = 1, 5528 .suite = { 5529 .comp = { 5530 .comp = __VECS(zlib_deflate_comp_tv_template), 5531 .decomp = __VECS(zlib_deflate_decomp_tv_template) 5532 } 5533 } 5534 }, { 5535 .alg = "zstd", 5536 .test = alg_test_comp, 5537 .fips_allowed = 1, 5538 .suite = { 5539 .comp = { 5540 .comp = __VECS(zstd_comp_tv_template), 5541 .decomp = __VECS(zstd_decomp_tv_template) 5542 } 5543 } 5544 } 5545 }; 5546 5547 static void alg_check_test_descs_order(void) 5548 { 5549 int i; 5550 5551 for (i = 1; i < ARRAY_SIZE(alg_test_descs); i++) { 5552 int diff = strcmp(alg_test_descs[i - 1].alg, 5553 alg_test_descs[i].alg); 5554 5555 if (WARN_ON(diff > 0)) { 5556 pr_warn("testmgr: alg_test_descs entries in wrong order: '%s' before '%s'\n", 5557 alg_test_descs[i - 1].alg, 5558 alg_test_descs[i].alg); 5559 } 5560 5561 if (WARN_ON(diff == 0)) { 5562 pr_warn("testmgr: duplicate alg_test_descs entry: '%s'\n", 5563 alg_test_descs[i].alg); 5564 } 5565 } 5566 } 5567 5568 static void alg_check_testvec_configs(void) 5569 { 5570 int i; 5571 5572 for (i = 0; i < ARRAY_SIZE(default_cipher_testvec_configs); i++) 5573 WARN_ON(!valid_testvec_config( 5574 &default_cipher_testvec_configs[i])); 5575 5576 for (i = 0; i < ARRAY_SIZE(default_hash_testvec_configs); i++) 5577 WARN_ON(!valid_testvec_config( 5578 &default_hash_testvec_configs[i])); 5579 } 5580 5581 static void testmgr_onetime_init(void) 5582 { 5583 alg_check_test_descs_order(); 5584 alg_check_testvec_configs(); 5585 5586 #ifdef CONFIG_CRYPTO_MANAGER_EXTRA_TESTS 5587 pr_warn("alg: extra crypto tests enabled. This is intended for developer use only.\n"); 5588 #endif 5589 } 5590 5591 static int alg_find_test(const char *alg) 5592 { 5593 int start = 0; 5594 int end = ARRAY_SIZE(alg_test_descs); 5595 5596 while (start < end) { 5597 int i = (start + end) / 2; 5598 int diff = strcmp(alg_test_descs[i].alg, alg); 5599 5600 if (diff > 0) { 5601 end = i; 5602 continue; 5603 } 5604 5605 if (diff < 0) { 5606 start = i + 1; 5607 continue; 5608 } 5609 5610 return i; 5611 } 5612 5613 return -1; 5614 } 5615 5616 int alg_test(const char *driver, const char *alg, u32 type, u32 mask) 5617 { 5618 int i; 5619 int j; 5620 int rc; 5621 5622 if (!fips_enabled && notests) { 5623 printk_once(KERN_INFO "alg: self-tests disabled\n"); 5624 return 0; 5625 } 5626 5627 DO_ONCE(testmgr_onetime_init); 5628 5629 if ((type & CRYPTO_ALG_TYPE_MASK) == CRYPTO_ALG_TYPE_CIPHER) { 5630 char nalg[CRYPTO_MAX_ALG_NAME]; 5631 5632 if (snprintf(nalg, sizeof(nalg), "ecb(%s)", alg) >= 5633 sizeof(nalg)) 5634 return -ENAMETOOLONG; 5635 5636 i = alg_find_test(nalg); 5637 if (i < 0) 5638 goto notest; 5639 5640 if (fips_enabled && !alg_test_descs[i].fips_allowed) 5641 goto non_fips_alg; 5642 5643 rc = alg_test_cipher(alg_test_descs + i, driver, type, mask); 5644 goto test_done; 5645 } 5646 5647 i = alg_find_test(alg); 5648 j = alg_find_test(driver); 5649 if (i < 0 && j < 0) 5650 goto notest; 5651 5652 if (fips_enabled && ((i >= 0 && !alg_test_descs[i].fips_allowed) || 5653 (j >= 0 && !alg_test_descs[j].fips_allowed))) 5654 goto non_fips_alg; 5655 5656 rc = 0; 5657 if (i >= 0) 5658 rc |= alg_test_descs[i].test(alg_test_descs + i, driver, 5659 type, mask); 5660 if (j >= 0 && j != i) 5661 rc |= alg_test_descs[j].test(alg_test_descs + j, driver, 5662 type, mask); 5663 5664 test_done: 5665 if (rc) { 5666 if (fips_enabled || panic_on_fail) { 5667 fips_fail_notify(); 5668 panic("alg: self-tests for %s (%s) failed in %s mode!\n", 5669 driver, alg, 5670 fips_enabled ? "fips" : "panic_on_fail"); 5671 } 5672 WARN(1, "alg: self-tests for %s (%s) failed (rc=%d)", 5673 driver, alg, rc); 5674 } else { 5675 if (fips_enabled) 5676 pr_info("alg: self-tests for %s (%s) passed\n", 5677 driver, alg); 5678 } 5679 5680 return rc; 5681 5682 notest: 5683 printk(KERN_INFO "alg: No test for %s (%s)\n", alg, driver); 5684 return 0; 5685 non_fips_alg: 5686 return -EINVAL; 5687 } 5688 5689 #endif /* CONFIG_CRYPTO_MANAGER_DISABLE_TESTS */ 5690 5691 EXPORT_SYMBOL_GPL(alg_test); 5692