xref: /openbmc/linux/crypto/testmgr.c (revision c9c28ed0)
1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3  * Algorithm testing framework and tests.
4  *
5  * Copyright (c) 2002 James Morris <jmorris@intercode.com.au>
6  * Copyright (c) 2002 Jean-Francois Dive <jef@linuxbe.org>
7  * Copyright (c) 2007 Nokia Siemens Networks
8  * Copyright (c) 2008 Herbert Xu <herbert@gondor.apana.org.au>
9  * Copyright (c) 2019 Google LLC
10  *
11  * Updated RFC4106 AES-GCM testing.
12  *    Authors: Aidan O'Mahony (aidan.o.mahony@intel.com)
13  *             Adrian Hoban <adrian.hoban@intel.com>
14  *             Gabriele Paoloni <gabriele.paoloni@intel.com>
15  *             Tadeusz Struk (tadeusz.struk@intel.com)
16  *    Copyright (c) 2010, Intel Corporation.
17  */
18 
19 #include <crypto/aead.h>
20 #include <crypto/hash.h>
21 #include <crypto/skcipher.h>
22 #include <linux/err.h>
23 #include <linux/fips.h>
24 #include <linux/module.h>
25 #include <linux/once.h>
26 #include <linux/random.h>
27 #include <linux/scatterlist.h>
28 #include <linux/slab.h>
29 #include <linux/string.h>
30 #include <linux/uio.h>
31 #include <crypto/rng.h>
32 #include <crypto/drbg.h>
33 #include <crypto/akcipher.h>
34 #include <crypto/kpp.h>
35 #include <crypto/acompress.h>
36 #include <crypto/internal/cipher.h>
37 #include <crypto/internal/simd.h>
38 
39 #include "internal.h"
40 
41 MODULE_IMPORT_NS(CRYPTO_INTERNAL);
42 
43 static bool notests;
44 module_param(notests, bool, 0644);
45 MODULE_PARM_DESC(notests, "disable crypto self-tests");
46 
47 static bool panic_on_fail;
48 module_param(panic_on_fail, bool, 0444);
49 
50 #ifdef CONFIG_CRYPTO_MANAGER_EXTRA_TESTS
51 static bool noextratests;
52 module_param(noextratests, bool, 0644);
53 MODULE_PARM_DESC(noextratests, "disable expensive crypto self-tests");
54 
55 static unsigned int fuzz_iterations = 100;
56 module_param(fuzz_iterations, uint, 0644);
57 MODULE_PARM_DESC(fuzz_iterations, "number of fuzz test iterations");
58 #endif
59 
60 #ifdef CONFIG_CRYPTO_MANAGER_DISABLE_TESTS
61 
62 /* a perfect nop */
63 int alg_test(const char *driver, const char *alg, u32 type, u32 mask)
64 {
65 	return 0;
66 }
67 
68 #else
69 
70 #include "testmgr.h"
71 
72 /*
73  * Need slab memory for testing (size in number of pages).
74  */
75 #define XBUFSIZE	8
76 
77 /*
78 * Used by test_cipher()
79 */
80 #define ENCRYPT 1
81 #define DECRYPT 0
82 
83 struct aead_test_suite {
84 	const struct aead_testvec *vecs;
85 	unsigned int count;
86 
87 	/*
88 	 * Set if trying to decrypt an inauthentic ciphertext with this
89 	 * algorithm might result in EINVAL rather than EBADMSG, due to other
90 	 * validation the algorithm does on the inputs such as length checks.
91 	 */
92 	unsigned int einval_allowed : 1;
93 
94 	/*
95 	 * Set if this algorithm requires that the IV be located at the end of
96 	 * the AAD buffer, in addition to being given in the normal way.  The
97 	 * behavior when the two IV copies differ is implementation-defined.
98 	 */
99 	unsigned int aad_iv : 1;
100 };
101 
102 struct cipher_test_suite {
103 	const struct cipher_testvec *vecs;
104 	unsigned int count;
105 };
106 
107 struct comp_test_suite {
108 	struct {
109 		const struct comp_testvec *vecs;
110 		unsigned int count;
111 	} comp, decomp;
112 };
113 
114 struct hash_test_suite {
115 	const struct hash_testvec *vecs;
116 	unsigned int count;
117 };
118 
119 struct cprng_test_suite {
120 	const struct cprng_testvec *vecs;
121 	unsigned int count;
122 };
123 
124 struct drbg_test_suite {
125 	const struct drbg_testvec *vecs;
126 	unsigned int count;
127 };
128 
129 struct akcipher_test_suite {
130 	const struct akcipher_testvec *vecs;
131 	unsigned int count;
132 };
133 
134 struct kpp_test_suite {
135 	const struct kpp_testvec *vecs;
136 	unsigned int count;
137 };
138 
139 struct alg_test_desc {
140 	const char *alg;
141 	const char *generic_driver;
142 	int (*test)(const struct alg_test_desc *desc, const char *driver,
143 		    u32 type, u32 mask);
144 	int fips_allowed;	/* set if alg is allowed in fips mode */
145 
146 	union {
147 		struct aead_test_suite aead;
148 		struct cipher_test_suite cipher;
149 		struct comp_test_suite comp;
150 		struct hash_test_suite hash;
151 		struct cprng_test_suite cprng;
152 		struct drbg_test_suite drbg;
153 		struct akcipher_test_suite akcipher;
154 		struct kpp_test_suite kpp;
155 	} suite;
156 };
157 
158 static void hexdump(unsigned char *buf, unsigned int len)
159 {
160 	print_hex_dump(KERN_CONT, "", DUMP_PREFIX_OFFSET,
161 			16, 1,
162 			buf, len, false);
163 }
164 
165 static int __testmgr_alloc_buf(char *buf[XBUFSIZE], int order)
166 {
167 	int i;
168 
169 	for (i = 0; i < XBUFSIZE; i++) {
170 		buf[i] = (char *)__get_free_pages(GFP_KERNEL, order);
171 		if (!buf[i])
172 			goto err_free_buf;
173 	}
174 
175 	return 0;
176 
177 err_free_buf:
178 	while (i-- > 0)
179 		free_pages((unsigned long)buf[i], order);
180 
181 	return -ENOMEM;
182 }
183 
184 static int testmgr_alloc_buf(char *buf[XBUFSIZE])
185 {
186 	return __testmgr_alloc_buf(buf, 0);
187 }
188 
189 static void __testmgr_free_buf(char *buf[XBUFSIZE], int order)
190 {
191 	int i;
192 
193 	for (i = 0; i < XBUFSIZE; i++)
194 		free_pages((unsigned long)buf[i], order);
195 }
196 
197 static void testmgr_free_buf(char *buf[XBUFSIZE])
198 {
199 	__testmgr_free_buf(buf, 0);
200 }
201 
202 #define TESTMGR_POISON_BYTE	0xfe
203 #define TESTMGR_POISON_LEN	16
204 
205 static inline void testmgr_poison(void *addr, size_t len)
206 {
207 	memset(addr, TESTMGR_POISON_BYTE, len);
208 }
209 
210 /* Is the memory region still fully poisoned? */
211 static inline bool testmgr_is_poison(const void *addr, size_t len)
212 {
213 	return memchr_inv(addr, TESTMGR_POISON_BYTE, len) == NULL;
214 }
215 
216 /* flush type for hash algorithms */
217 enum flush_type {
218 	/* merge with update of previous buffer(s) */
219 	FLUSH_TYPE_NONE = 0,
220 
221 	/* update with previous buffer(s) before doing this one */
222 	FLUSH_TYPE_FLUSH,
223 
224 	/* likewise, but also export and re-import the intermediate state */
225 	FLUSH_TYPE_REIMPORT,
226 };
227 
228 /* finalization function for hash algorithms */
229 enum finalization_type {
230 	FINALIZATION_TYPE_FINAL,	/* use final() */
231 	FINALIZATION_TYPE_FINUP,	/* use finup() */
232 	FINALIZATION_TYPE_DIGEST,	/* use digest() */
233 };
234 
235 #define TEST_SG_TOTAL	10000
236 
237 /**
238  * struct test_sg_division - description of a scatterlist entry
239  *
240  * This struct describes one entry of a scatterlist being constructed to check a
241  * crypto test vector.
242  *
243  * @proportion_of_total: length of this chunk relative to the total length,
244  *			 given as a proportion out of TEST_SG_TOTAL so that it
245  *			 scales to fit any test vector
246  * @offset: byte offset into a 2-page buffer at which this chunk will start
247  * @offset_relative_to_alignmask: if true, add the algorithm's alignmask to the
248  *				  @offset
249  * @flush_type: for hashes, whether an update() should be done now vs.
250  *		continuing to accumulate data
251  * @nosimd: if doing the pending update(), do it with SIMD disabled?
252  */
253 struct test_sg_division {
254 	unsigned int proportion_of_total;
255 	unsigned int offset;
256 	bool offset_relative_to_alignmask;
257 	enum flush_type flush_type;
258 	bool nosimd;
259 };
260 
261 /**
262  * struct testvec_config - configuration for testing a crypto test vector
263  *
264  * This struct describes the data layout and other parameters with which each
265  * crypto test vector can be tested.
266  *
267  * @name: name of this config, logged for debugging purposes if a test fails
268  * @inplace: operate on the data in-place, if applicable for the algorithm type?
269  * @req_flags: extra request_flags, e.g. CRYPTO_TFM_REQ_MAY_SLEEP
270  * @src_divs: description of how to arrange the source scatterlist
271  * @dst_divs: description of how to arrange the dst scatterlist, if applicable
272  *	      for the algorithm type.  Defaults to @src_divs if unset.
273  * @iv_offset: misalignment of the IV in the range [0..MAX_ALGAPI_ALIGNMASK+1],
274  *	       where 0 is aligned to a 2*(MAX_ALGAPI_ALIGNMASK+1) byte boundary
275  * @iv_offset_relative_to_alignmask: if true, add the algorithm's alignmask to
276  *				     the @iv_offset
277  * @key_offset: misalignment of the key, where 0 is default alignment
278  * @key_offset_relative_to_alignmask: if true, add the algorithm's alignmask to
279  *				      the @key_offset
280  * @finalization_type: what finalization function to use for hashes
281  * @nosimd: execute with SIMD disabled?  Requires !CRYPTO_TFM_REQ_MAY_SLEEP.
282  */
283 struct testvec_config {
284 	const char *name;
285 	bool inplace;
286 	u32 req_flags;
287 	struct test_sg_division src_divs[XBUFSIZE];
288 	struct test_sg_division dst_divs[XBUFSIZE];
289 	unsigned int iv_offset;
290 	unsigned int key_offset;
291 	bool iv_offset_relative_to_alignmask;
292 	bool key_offset_relative_to_alignmask;
293 	enum finalization_type finalization_type;
294 	bool nosimd;
295 };
296 
297 #define TESTVEC_CONFIG_NAMELEN	192
298 
299 /*
300  * The following are the lists of testvec_configs to test for each algorithm
301  * type when the basic crypto self-tests are enabled, i.e. when
302  * CONFIG_CRYPTO_MANAGER_DISABLE_TESTS is unset.  They aim to provide good test
303  * coverage, while keeping the test time much shorter than the full fuzz tests
304  * so that the basic tests can be enabled in a wider range of circumstances.
305  */
306 
307 /* Configs for skciphers and aeads */
308 static const struct testvec_config default_cipher_testvec_configs[] = {
309 	{
310 		.name = "in-place",
311 		.inplace = true,
312 		.src_divs = { { .proportion_of_total = 10000 } },
313 	}, {
314 		.name = "out-of-place",
315 		.src_divs = { { .proportion_of_total = 10000 } },
316 	}, {
317 		.name = "unaligned buffer, offset=1",
318 		.src_divs = { { .proportion_of_total = 10000, .offset = 1 } },
319 		.iv_offset = 1,
320 		.key_offset = 1,
321 	}, {
322 		.name = "buffer aligned only to alignmask",
323 		.src_divs = {
324 			{
325 				.proportion_of_total = 10000,
326 				.offset = 1,
327 				.offset_relative_to_alignmask = true,
328 			},
329 		},
330 		.iv_offset = 1,
331 		.iv_offset_relative_to_alignmask = true,
332 		.key_offset = 1,
333 		.key_offset_relative_to_alignmask = true,
334 	}, {
335 		.name = "two even aligned splits",
336 		.src_divs = {
337 			{ .proportion_of_total = 5000 },
338 			{ .proportion_of_total = 5000 },
339 		},
340 	}, {
341 		.name = "uneven misaligned splits, may sleep",
342 		.req_flags = CRYPTO_TFM_REQ_MAY_SLEEP,
343 		.src_divs = {
344 			{ .proportion_of_total = 1900, .offset = 33 },
345 			{ .proportion_of_total = 3300, .offset = 7  },
346 			{ .proportion_of_total = 4800, .offset = 18 },
347 		},
348 		.iv_offset = 3,
349 		.key_offset = 3,
350 	}, {
351 		.name = "misaligned splits crossing pages, inplace",
352 		.inplace = true,
353 		.src_divs = {
354 			{
355 				.proportion_of_total = 7500,
356 				.offset = PAGE_SIZE - 32
357 			}, {
358 				.proportion_of_total = 2500,
359 				.offset = PAGE_SIZE - 7
360 			},
361 		},
362 	}
363 };
364 
365 static const struct testvec_config default_hash_testvec_configs[] = {
366 	{
367 		.name = "init+update+final aligned buffer",
368 		.src_divs = { { .proportion_of_total = 10000 } },
369 		.finalization_type = FINALIZATION_TYPE_FINAL,
370 	}, {
371 		.name = "init+finup aligned buffer",
372 		.src_divs = { { .proportion_of_total = 10000 } },
373 		.finalization_type = FINALIZATION_TYPE_FINUP,
374 	}, {
375 		.name = "digest aligned buffer",
376 		.src_divs = { { .proportion_of_total = 10000 } },
377 		.finalization_type = FINALIZATION_TYPE_DIGEST,
378 	}, {
379 		.name = "init+update+final misaligned buffer",
380 		.src_divs = { { .proportion_of_total = 10000, .offset = 1 } },
381 		.finalization_type = FINALIZATION_TYPE_FINAL,
382 		.key_offset = 1,
383 	}, {
384 		.name = "digest buffer aligned only to alignmask",
385 		.src_divs = {
386 			{
387 				.proportion_of_total = 10000,
388 				.offset = 1,
389 				.offset_relative_to_alignmask = true,
390 			},
391 		},
392 		.finalization_type = FINALIZATION_TYPE_DIGEST,
393 		.key_offset = 1,
394 		.key_offset_relative_to_alignmask = true,
395 	}, {
396 		.name = "init+update+update+final two even splits",
397 		.src_divs = {
398 			{ .proportion_of_total = 5000 },
399 			{
400 				.proportion_of_total = 5000,
401 				.flush_type = FLUSH_TYPE_FLUSH,
402 			},
403 		},
404 		.finalization_type = FINALIZATION_TYPE_FINAL,
405 	}, {
406 		.name = "digest uneven misaligned splits, may sleep",
407 		.req_flags = CRYPTO_TFM_REQ_MAY_SLEEP,
408 		.src_divs = {
409 			{ .proportion_of_total = 1900, .offset = 33 },
410 			{ .proportion_of_total = 3300, .offset = 7  },
411 			{ .proportion_of_total = 4800, .offset = 18 },
412 		},
413 		.finalization_type = FINALIZATION_TYPE_DIGEST,
414 	}, {
415 		.name = "digest misaligned splits crossing pages",
416 		.src_divs = {
417 			{
418 				.proportion_of_total = 7500,
419 				.offset = PAGE_SIZE - 32,
420 			}, {
421 				.proportion_of_total = 2500,
422 				.offset = PAGE_SIZE - 7,
423 			},
424 		},
425 		.finalization_type = FINALIZATION_TYPE_DIGEST,
426 	}, {
427 		.name = "import/export",
428 		.src_divs = {
429 			{
430 				.proportion_of_total = 6500,
431 				.flush_type = FLUSH_TYPE_REIMPORT,
432 			}, {
433 				.proportion_of_total = 3500,
434 				.flush_type = FLUSH_TYPE_REIMPORT,
435 			},
436 		},
437 		.finalization_type = FINALIZATION_TYPE_FINAL,
438 	}
439 };
440 
441 static unsigned int count_test_sg_divisions(const struct test_sg_division *divs)
442 {
443 	unsigned int remaining = TEST_SG_TOTAL;
444 	unsigned int ndivs = 0;
445 
446 	do {
447 		remaining -= divs[ndivs++].proportion_of_total;
448 	} while (remaining);
449 
450 	return ndivs;
451 }
452 
453 #define SGDIVS_HAVE_FLUSHES	BIT(0)
454 #define SGDIVS_HAVE_NOSIMD	BIT(1)
455 
456 static bool valid_sg_divisions(const struct test_sg_division *divs,
457 			       unsigned int count, int *flags_ret)
458 {
459 	unsigned int total = 0;
460 	unsigned int i;
461 
462 	for (i = 0; i < count && total != TEST_SG_TOTAL; i++) {
463 		if (divs[i].proportion_of_total <= 0 ||
464 		    divs[i].proportion_of_total > TEST_SG_TOTAL - total)
465 			return false;
466 		total += divs[i].proportion_of_total;
467 		if (divs[i].flush_type != FLUSH_TYPE_NONE)
468 			*flags_ret |= SGDIVS_HAVE_FLUSHES;
469 		if (divs[i].nosimd)
470 			*flags_ret |= SGDIVS_HAVE_NOSIMD;
471 	}
472 	return total == TEST_SG_TOTAL &&
473 		memchr_inv(&divs[i], 0, (count - i) * sizeof(divs[0])) == NULL;
474 }
475 
476 /*
477  * Check whether the given testvec_config is valid.  This isn't strictly needed
478  * since every testvec_config should be valid, but check anyway so that people
479  * don't unknowingly add broken configs that don't do what they wanted.
480  */
481 static bool valid_testvec_config(const struct testvec_config *cfg)
482 {
483 	int flags = 0;
484 
485 	if (cfg->name == NULL)
486 		return false;
487 
488 	if (!valid_sg_divisions(cfg->src_divs, ARRAY_SIZE(cfg->src_divs),
489 				&flags))
490 		return false;
491 
492 	if (cfg->dst_divs[0].proportion_of_total) {
493 		if (!valid_sg_divisions(cfg->dst_divs,
494 					ARRAY_SIZE(cfg->dst_divs), &flags))
495 			return false;
496 	} else {
497 		if (memchr_inv(cfg->dst_divs, 0, sizeof(cfg->dst_divs)))
498 			return false;
499 		/* defaults to dst_divs=src_divs */
500 	}
501 
502 	if (cfg->iv_offset +
503 	    (cfg->iv_offset_relative_to_alignmask ? MAX_ALGAPI_ALIGNMASK : 0) >
504 	    MAX_ALGAPI_ALIGNMASK + 1)
505 		return false;
506 
507 	if ((flags & (SGDIVS_HAVE_FLUSHES | SGDIVS_HAVE_NOSIMD)) &&
508 	    cfg->finalization_type == FINALIZATION_TYPE_DIGEST)
509 		return false;
510 
511 	if ((cfg->nosimd || (flags & SGDIVS_HAVE_NOSIMD)) &&
512 	    (cfg->req_flags & CRYPTO_TFM_REQ_MAY_SLEEP))
513 		return false;
514 
515 	return true;
516 }
517 
518 struct test_sglist {
519 	char *bufs[XBUFSIZE];
520 	struct scatterlist sgl[XBUFSIZE];
521 	struct scatterlist sgl_saved[XBUFSIZE];
522 	struct scatterlist *sgl_ptr;
523 	unsigned int nents;
524 };
525 
526 static int init_test_sglist(struct test_sglist *tsgl)
527 {
528 	return __testmgr_alloc_buf(tsgl->bufs, 1 /* two pages per buffer */);
529 }
530 
531 static void destroy_test_sglist(struct test_sglist *tsgl)
532 {
533 	return __testmgr_free_buf(tsgl->bufs, 1 /* two pages per buffer */);
534 }
535 
536 /**
537  * build_test_sglist() - build a scatterlist for a crypto test
538  *
539  * @tsgl: the scatterlist to build.  @tsgl->bufs[] contains an array of 2-page
540  *	  buffers which the scatterlist @tsgl->sgl[] will be made to point into.
541  * @divs: the layout specification on which the scatterlist will be based
542  * @alignmask: the algorithm's alignmask
543  * @total_len: the total length of the scatterlist to build in bytes
544  * @data: if non-NULL, the buffers will be filled with this data until it ends.
545  *	  Otherwise the buffers will be poisoned.  In both cases, some bytes
546  *	  past the end of each buffer will be poisoned to help detect overruns.
547  * @out_divs: if non-NULL, the test_sg_division to which each scatterlist entry
548  *	      corresponds will be returned here.  This will match @divs except
549  *	      that divisions resolving to a length of 0 are omitted as they are
550  *	      not included in the scatterlist.
551  *
552  * Return: 0 or a -errno value
553  */
554 static int build_test_sglist(struct test_sglist *tsgl,
555 			     const struct test_sg_division *divs,
556 			     const unsigned int alignmask,
557 			     const unsigned int total_len,
558 			     struct iov_iter *data,
559 			     const struct test_sg_division *out_divs[XBUFSIZE])
560 {
561 	struct {
562 		const struct test_sg_division *div;
563 		size_t length;
564 	} partitions[XBUFSIZE];
565 	const unsigned int ndivs = count_test_sg_divisions(divs);
566 	unsigned int len_remaining = total_len;
567 	unsigned int i;
568 
569 	BUILD_BUG_ON(ARRAY_SIZE(partitions) != ARRAY_SIZE(tsgl->sgl));
570 	if (WARN_ON(ndivs > ARRAY_SIZE(partitions)))
571 		return -EINVAL;
572 
573 	/* Calculate the (div, length) pairs */
574 	tsgl->nents = 0;
575 	for (i = 0; i < ndivs; i++) {
576 		unsigned int len_this_sg =
577 			min(len_remaining,
578 			    (total_len * divs[i].proportion_of_total +
579 			     TEST_SG_TOTAL / 2) / TEST_SG_TOTAL);
580 
581 		if (len_this_sg != 0) {
582 			partitions[tsgl->nents].div = &divs[i];
583 			partitions[tsgl->nents].length = len_this_sg;
584 			tsgl->nents++;
585 			len_remaining -= len_this_sg;
586 		}
587 	}
588 	if (tsgl->nents == 0) {
589 		partitions[tsgl->nents].div = &divs[0];
590 		partitions[tsgl->nents].length = 0;
591 		tsgl->nents++;
592 	}
593 	partitions[tsgl->nents - 1].length += len_remaining;
594 
595 	/* Set up the sgl entries and fill the data or poison */
596 	sg_init_table(tsgl->sgl, tsgl->nents);
597 	for (i = 0; i < tsgl->nents; i++) {
598 		unsigned int offset = partitions[i].div->offset;
599 		void *addr;
600 
601 		if (partitions[i].div->offset_relative_to_alignmask)
602 			offset += alignmask;
603 
604 		while (offset + partitions[i].length + TESTMGR_POISON_LEN >
605 		       2 * PAGE_SIZE) {
606 			if (WARN_ON(offset <= 0))
607 				return -EINVAL;
608 			offset /= 2;
609 		}
610 
611 		addr = &tsgl->bufs[i][offset];
612 		sg_set_buf(&tsgl->sgl[i], addr, partitions[i].length);
613 
614 		if (out_divs)
615 			out_divs[i] = partitions[i].div;
616 
617 		if (data) {
618 			size_t copy_len, copied;
619 
620 			copy_len = min(partitions[i].length, data->count);
621 			copied = copy_from_iter(addr, copy_len, data);
622 			if (WARN_ON(copied != copy_len))
623 				return -EINVAL;
624 			testmgr_poison(addr + copy_len, partitions[i].length +
625 				       TESTMGR_POISON_LEN - copy_len);
626 		} else {
627 			testmgr_poison(addr, partitions[i].length +
628 				       TESTMGR_POISON_LEN);
629 		}
630 	}
631 
632 	sg_mark_end(&tsgl->sgl[tsgl->nents - 1]);
633 	tsgl->sgl_ptr = tsgl->sgl;
634 	memcpy(tsgl->sgl_saved, tsgl->sgl, tsgl->nents * sizeof(tsgl->sgl[0]));
635 	return 0;
636 }
637 
638 /*
639  * Verify that a scatterlist crypto operation produced the correct output.
640  *
641  * @tsgl: scatterlist containing the actual output
642  * @expected_output: buffer containing the expected output
643  * @len_to_check: length of @expected_output in bytes
644  * @unchecked_prefix_len: number of ignored bytes in @tsgl prior to real result
645  * @check_poison: verify that the poison bytes after each chunk are intact?
646  *
647  * Return: 0 if correct, -EINVAL if incorrect, -EOVERFLOW if buffer overrun.
648  */
649 static int verify_correct_output(const struct test_sglist *tsgl,
650 				 const char *expected_output,
651 				 unsigned int len_to_check,
652 				 unsigned int unchecked_prefix_len,
653 				 bool check_poison)
654 {
655 	unsigned int i;
656 
657 	for (i = 0; i < tsgl->nents; i++) {
658 		struct scatterlist *sg = &tsgl->sgl_ptr[i];
659 		unsigned int len = sg->length;
660 		unsigned int offset = sg->offset;
661 		const char *actual_output;
662 
663 		if (unchecked_prefix_len) {
664 			if (unchecked_prefix_len >= len) {
665 				unchecked_prefix_len -= len;
666 				continue;
667 			}
668 			offset += unchecked_prefix_len;
669 			len -= unchecked_prefix_len;
670 			unchecked_prefix_len = 0;
671 		}
672 		len = min(len, len_to_check);
673 		actual_output = page_address(sg_page(sg)) + offset;
674 		if (memcmp(expected_output, actual_output, len) != 0)
675 			return -EINVAL;
676 		if (check_poison &&
677 		    !testmgr_is_poison(actual_output + len, TESTMGR_POISON_LEN))
678 			return -EOVERFLOW;
679 		len_to_check -= len;
680 		expected_output += len;
681 	}
682 	if (WARN_ON(len_to_check != 0))
683 		return -EINVAL;
684 	return 0;
685 }
686 
687 static bool is_test_sglist_corrupted(const struct test_sglist *tsgl)
688 {
689 	unsigned int i;
690 
691 	for (i = 0; i < tsgl->nents; i++) {
692 		if (tsgl->sgl[i].page_link != tsgl->sgl_saved[i].page_link)
693 			return true;
694 		if (tsgl->sgl[i].offset != tsgl->sgl_saved[i].offset)
695 			return true;
696 		if (tsgl->sgl[i].length != tsgl->sgl_saved[i].length)
697 			return true;
698 	}
699 	return false;
700 }
701 
702 struct cipher_test_sglists {
703 	struct test_sglist src;
704 	struct test_sglist dst;
705 };
706 
707 static struct cipher_test_sglists *alloc_cipher_test_sglists(void)
708 {
709 	struct cipher_test_sglists *tsgls;
710 
711 	tsgls = kmalloc(sizeof(*tsgls), GFP_KERNEL);
712 	if (!tsgls)
713 		return NULL;
714 
715 	if (init_test_sglist(&tsgls->src) != 0)
716 		goto fail_kfree;
717 	if (init_test_sglist(&tsgls->dst) != 0)
718 		goto fail_destroy_src;
719 
720 	return tsgls;
721 
722 fail_destroy_src:
723 	destroy_test_sglist(&tsgls->src);
724 fail_kfree:
725 	kfree(tsgls);
726 	return NULL;
727 }
728 
729 static void free_cipher_test_sglists(struct cipher_test_sglists *tsgls)
730 {
731 	if (tsgls) {
732 		destroy_test_sglist(&tsgls->src);
733 		destroy_test_sglist(&tsgls->dst);
734 		kfree(tsgls);
735 	}
736 }
737 
738 /* Build the src and dst scatterlists for an skcipher or AEAD test */
739 static int build_cipher_test_sglists(struct cipher_test_sglists *tsgls,
740 				     const struct testvec_config *cfg,
741 				     unsigned int alignmask,
742 				     unsigned int src_total_len,
743 				     unsigned int dst_total_len,
744 				     const struct kvec *inputs,
745 				     unsigned int nr_inputs)
746 {
747 	struct iov_iter input;
748 	int err;
749 
750 	iov_iter_kvec(&input, WRITE, inputs, nr_inputs, src_total_len);
751 	err = build_test_sglist(&tsgls->src, cfg->src_divs, alignmask,
752 				cfg->inplace ?
753 					max(dst_total_len, src_total_len) :
754 					src_total_len,
755 				&input, NULL);
756 	if (err)
757 		return err;
758 
759 	if (cfg->inplace) {
760 		tsgls->dst.sgl_ptr = tsgls->src.sgl;
761 		tsgls->dst.nents = tsgls->src.nents;
762 		return 0;
763 	}
764 	return build_test_sglist(&tsgls->dst,
765 				 cfg->dst_divs[0].proportion_of_total ?
766 					cfg->dst_divs : cfg->src_divs,
767 				 alignmask, dst_total_len, NULL, NULL);
768 }
769 
770 /*
771  * Support for testing passing a misaligned key to setkey():
772  *
773  * If cfg->key_offset is set, copy the key into a new buffer at that offset,
774  * optionally adding alignmask.  Else, just use the key directly.
775  */
776 static int prepare_keybuf(const u8 *key, unsigned int ksize,
777 			  const struct testvec_config *cfg,
778 			  unsigned int alignmask,
779 			  const u8 **keybuf_ret, const u8 **keyptr_ret)
780 {
781 	unsigned int key_offset = cfg->key_offset;
782 	u8 *keybuf = NULL, *keyptr = (u8 *)key;
783 
784 	if (key_offset != 0) {
785 		if (cfg->key_offset_relative_to_alignmask)
786 			key_offset += alignmask;
787 		keybuf = kmalloc(key_offset + ksize, GFP_KERNEL);
788 		if (!keybuf)
789 			return -ENOMEM;
790 		keyptr = keybuf + key_offset;
791 		memcpy(keyptr, key, ksize);
792 	}
793 	*keybuf_ret = keybuf;
794 	*keyptr_ret = keyptr;
795 	return 0;
796 }
797 
798 /* Like setkey_f(tfm, key, ksize), but sometimes misalign the key */
799 #define do_setkey(setkey_f, tfm, key, ksize, cfg, alignmask)		\
800 ({									\
801 	const u8 *keybuf, *keyptr;					\
802 	int err;							\
803 									\
804 	err = prepare_keybuf((key), (ksize), (cfg), (alignmask),	\
805 			     &keybuf, &keyptr);				\
806 	if (err == 0) {							\
807 		err = setkey_f((tfm), keyptr, (ksize));			\
808 		kfree(keybuf);						\
809 	}								\
810 	err;								\
811 })
812 
813 #ifdef CONFIG_CRYPTO_MANAGER_EXTRA_TESTS
814 
815 /* Generate a random length in range [0, max_len], but prefer smaller values */
816 static unsigned int generate_random_length(unsigned int max_len)
817 {
818 	unsigned int len = prandom_u32() % (max_len + 1);
819 
820 	switch (prandom_u32() % 4) {
821 	case 0:
822 		return len % 64;
823 	case 1:
824 		return len % 256;
825 	case 2:
826 		return len % 1024;
827 	default:
828 		return len;
829 	}
830 }
831 
832 /* Flip a random bit in the given nonempty data buffer */
833 static void flip_random_bit(u8 *buf, size_t size)
834 {
835 	size_t bitpos;
836 
837 	bitpos = prandom_u32() % (size * 8);
838 	buf[bitpos / 8] ^= 1 << (bitpos % 8);
839 }
840 
841 /* Flip a random byte in the given nonempty data buffer */
842 static void flip_random_byte(u8 *buf, size_t size)
843 {
844 	buf[prandom_u32() % size] ^= 0xff;
845 }
846 
847 /* Sometimes make some random changes to the given nonempty data buffer */
848 static void mutate_buffer(u8 *buf, size_t size)
849 {
850 	size_t num_flips;
851 	size_t i;
852 
853 	/* Sometimes flip some bits */
854 	if (prandom_u32() % 4 == 0) {
855 		num_flips = min_t(size_t, 1 << (prandom_u32() % 8), size * 8);
856 		for (i = 0; i < num_flips; i++)
857 			flip_random_bit(buf, size);
858 	}
859 
860 	/* Sometimes flip some bytes */
861 	if (prandom_u32() % 4 == 0) {
862 		num_flips = min_t(size_t, 1 << (prandom_u32() % 8), size);
863 		for (i = 0; i < num_flips; i++)
864 			flip_random_byte(buf, size);
865 	}
866 }
867 
868 /* Randomly generate 'count' bytes, but sometimes make them "interesting" */
869 static void generate_random_bytes(u8 *buf, size_t count)
870 {
871 	u8 b;
872 	u8 increment;
873 	size_t i;
874 
875 	if (count == 0)
876 		return;
877 
878 	switch (prandom_u32() % 8) { /* Choose a generation strategy */
879 	case 0:
880 	case 1:
881 		/* All the same byte, plus optional mutations */
882 		switch (prandom_u32() % 4) {
883 		case 0:
884 			b = 0x00;
885 			break;
886 		case 1:
887 			b = 0xff;
888 			break;
889 		default:
890 			b = (u8)prandom_u32();
891 			break;
892 		}
893 		memset(buf, b, count);
894 		mutate_buffer(buf, count);
895 		break;
896 	case 2:
897 		/* Ascending or descending bytes, plus optional mutations */
898 		increment = (u8)prandom_u32();
899 		b = (u8)prandom_u32();
900 		for (i = 0; i < count; i++, b += increment)
901 			buf[i] = b;
902 		mutate_buffer(buf, count);
903 		break;
904 	default:
905 		/* Fully random bytes */
906 		for (i = 0; i < count; i++)
907 			buf[i] = (u8)prandom_u32();
908 	}
909 }
910 
911 static char *generate_random_sgl_divisions(struct test_sg_division *divs,
912 					   size_t max_divs, char *p, char *end,
913 					   bool gen_flushes, u32 req_flags)
914 {
915 	struct test_sg_division *div = divs;
916 	unsigned int remaining = TEST_SG_TOTAL;
917 
918 	do {
919 		unsigned int this_len;
920 		const char *flushtype_str;
921 
922 		if (div == &divs[max_divs - 1] || prandom_u32() % 2 == 0)
923 			this_len = remaining;
924 		else
925 			this_len = 1 + (prandom_u32() % remaining);
926 		div->proportion_of_total = this_len;
927 
928 		if (prandom_u32() % 4 == 0)
929 			div->offset = (PAGE_SIZE - 128) + (prandom_u32() % 128);
930 		else if (prandom_u32() % 2 == 0)
931 			div->offset = prandom_u32() % 32;
932 		else
933 			div->offset = prandom_u32() % PAGE_SIZE;
934 		if (prandom_u32() % 8 == 0)
935 			div->offset_relative_to_alignmask = true;
936 
937 		div->flush_type = FLUSH_TYPE_NONE;
938 		if (gen_flushes) {
939 			switch (prandom_u32() % 4) {
940 			case 0:
941 				div->flush_type = FLUSH_TYPE_REIMPORT;
942 				break;
943 			case 1:
944 				div->flush_type = FLUSH_TYPE_FLUSH;
945 				break;
946 			}
947 		}
948 
949 		if (div->flush_type != FLUSH_TYPE_NONE &&
950 		    !(req_flags & CRYPTO_TFM_REQ_MAY_SLEEP) &&
951 		    prandom_u32() % 2 == 0)
952 			div->nosimd = true;
953 
954 		switch (div->flush_type) {
955 		case FLUSH_TYPE_FLUSH:
956 			if (div->nosimd)
957 				flushtype_str = "<flush,nosimd>";
958 			else
959 				flushtype_str = "<flush>";
960 			break;
961 		case FLUSH_TYPE_REIMPORT:
962 			if (div->nosimd)
963 				flushtype_str = "<reimport,nosimd>";
964 			else
965 				flushtype_str = "<reimport>";
966 			break;
967 		default:
968 			flushtype_str = "";
969 			break;
970 		}
971 
972 		BUILD_BUG_ON(TEST_SG_TOTAL != 10000); /* for "%u.%u%%" */
973 		p += scnprintf(p, end - p, "%s%u.%u%%@%s+%u%s", flushtype_str,
974 			       this_len / 100, this_len % 100,
975 			       div->offset_relative_to_alignmask ?
976 					"alignmask" : "",
977 			       div->offset, this_len == remaining ? "" : ", ");
978 		remaining -= this_len;
979 		div++;
980 	} while (remaining);
981 
982 	return p;
983 }
984 
985 /* Generate a random testvec_config for fuzz testing */
986 static void generate_random_testvec_config(struct testvec_config *cfg,
987 					   char *name, size_t max_namelen)
988 {
989 	char *p = name;
990 	char * const end = name + max_namelen;
991 
992 	memset(cfg, 0, sizeof(*cfg));
993 
994 	cfg->name = name;
995 
996 	p += scnprintf(p, end - p, "random:");
997 
998 	if (prandom_u32() % 2 == 0) {
999 		cfg->inplace = true;
1000 		p += scnprintf(p, end - p, " inplace");
1001 	}
1002 
1003 	if (prandom_u32() % 2 == 0) {
1004 		cfg->req_flags |= CRYPTO_TFM_REQ_MAY_SLEEP;
1005 		p += scnprintf(p, end - p, " may_sleep");
1006 	}
1007 
1008 	switch (prandom_u32() % 4) {
1009 	case 0:
1010 		cfg->finalization_type = FINALIZATION_TYPE_FINAL;
1011 		p += scnprintf(p, end - p, " use_final");
1012 		break;
1013 	case 1:
1014 		cfg->finalization_type = FINALIZATION_TYPE_FINUP;
1015 		p += scnprintf(p, end - p, " use_finup");
1016 		break;
1017 	default:
1018 		cfg->finalization_type = FINALIZATION_TYPE_DIGEST;
1019 		p += scnprintf(p, end - p, " use_digest");
1020 		break;
1021 	}
1022 
1023 	if (!(cfg->req_flags & CRYPTO_TFM_REQ_MAY_SLEEP) &&
1024 	    prandom_u32() % 2 == 0) {
1025 		cfg->nosimd = true;
1026 		p += scnprintf(p, end - p, " nosimd");
1027 	}
1028 
1029 	p += scnprintf(p, end - p, " src_divs=[");
1030 	p = generate_random_sgl_divisions(cfg->src_divs,
1031 					  ARRAY_SIZE(cfg->src_divs), p, end,
1032 					  (cfg->finalization_type !=
1033 					   FINALIZATION_TYPE_DIGEST),
1034 					  cfg->req_flags);
1035 	p += scnprintf(p, end - p, "]");
1036 
1037 	if (!cfg->inplace && prandom_u32() % 2 == 0) {
1038 		p += scnprintf(p, end - p, " dst_divs=[");
1039 		p = generate_random_sgl_divisions(cfg->dst_divs,
1040 						  ARRAY_SIZE(cfg->dst_divs),
1041 						  p, end, false,
1042 						  cfg->req_flags);
1043 		p += scnprintf(p, end - p, "]");
1044 	}
1045 
1046 	if (prandom_u32() % 2 == 0) {
1047 		cfg->iv_offset = 1 + (prandom_u32() % MAX_ALGAPI_ALIGNMASK);
1048 		p += scnprintf(p, end - p, " iv_offset=%u", cfg->iv_offset);
1049 	}
1050 
1051 	if (prandom_u32() % 2 == 0) {
1052 		cfg->key_offset = 1 + (prandom_u32() % MAX_ALGAPI_ALIGNMASK);
1053 		p += scnprintf(p, end - p, " key_offset=%u", cfg->key_offset);
1054 	}
1055 
1056 	WARN_ON_ONCE(!valid_testvec_config(cfg));
1057 }
1058 
1059 static void crypto_disable_simd_for_test(void)
1060 {
1061 	migrate_disable();
1062 	__this_cpu_write(crypto_simd_disabled_for_test, true);
1063 }
1064 
1065 static void crypto_reenable_simd_for_test(void)
1066 {
1067 	__this_cpu_write(crypto_simd_disabled_for_test, false);
1068 	migrate_enable();
1069 }
1070 
1071 /*
1072  * Given an algorithm name, build the name of the generic implementation of that
1073  * algorithm, assuming the usual naming convention.  Specifically, this appends
1074  * "-generic" to every part of the name that is not a template name.  Examples:
1075  *
1076  *	aes => aes-generic
1077  *	cbc(aes) => cbc(aes-generic)
1078  *	cts(cbc(aes)) => cts(cbc(aes-generic))
1079  *	rfc7539(chacha20,poly1305) => rfc7539(chacha20-generic,poly1305-generic)
1080  *
1081  * Return: 0 on success, or -ENAMETOOLONG if the generic name would be too long
1082  */
1083 static int build_generic_driver_name(const char *algname,
1084 				     char driver_name[CRYPTO_MAX_ALG_NAME])
1085 {
1086 	const char *in = algname;
1087 	char *out = driver_name;
1088 	size_t len = strlen(algname);
1089 
1090 	if (len >= CRYPTO_MAX_ALG_NAME)
1091 		goto too_long;
1092 	do {
1093 		const char *in_saved = in;
1094 
1095 		while (*in && *in != '(' && *in != ')' && *in != ',')
1096 			*out++ = *in++;
1097 		if (*in != '(' && in > in_saved) {
1098 			len += 8;
1099 			if (len >= CRYPTO_MAX_ALG_NAME)
1100 				goto too_long;
1101 			memcpy(out, "-generic", 8);
1102 			out += 8;
1103 		}
1104 	} while ((*out++ = *in++) != '\0');
1105 	return 0;
1106 
1107 too_long:
1108 	pr_err("alg: generic driver name for \"%s\" would be too long\n",
1109 	       algname);
1110 	return -ENAMETOOLONG;
1111 }
1112 #else /* !CONFIG_CRYPTO_MANAGER_EXTRA_TESTS */
1113 static void crypto_disable_simd_for_test(void)
1114 {
1115 }
1116 
1117 static void crypto_reenable_simd_for_test(void)
1118 {
1119 }
1120 #endif /* !CONFIG_CRYPTO_MANAGER_EXTRA_TESTS */
1121 
1122 static int build_hash_sglist(struct test_sglist *tsgl,
1123 			     const struct hash_testvec *vec,
1124 			     const struct testvec_config *cfg,
1125 			     unsigned int alignmask,
1126 			     const struct test_sg_division *divs[XBUFSIZE])
1127 {
1128 	struct kvec kv;
1129 	struct iov_iter input;
1130 
1131 	kv.iov_base = (void *)vec->plaintext;
1132 	kv.iov_len = vec->psize;
1133 	iov_iter_kvec(&input, WRITE, &kv, 1, vec->psize);
1134 	return build_test_sglist(tsgl, cfg->src_divs, alignmask, vec->psize,
1135 				 &input, divs);
1136 }
1137 
1138 static int check_hash_result(const char *type,
1139 			     const u8 *result, unsigned int digestsize,
1140 			     const struct hash_testvec *vec,
1141 			     const char *vec_name,
1142 			     const char *driver,
1143 			     const struct testvec_config *cfg)
1144 {
1145 	if (memcmp(result, vec->digest, digestsize) != 0) {
1146 		pr_err("alg: %s: %s test failed (wrong result) on test vector %s, cfg=\"%s\"\n",
1147 		       type, driver, vec_name, cfg->name);
1148 		return -EINVAL;
1149 	}
1150 	if (!testmgr_is_poison(&result[digestsize], TESTMGR_POISON_LEN)) {
1151 		pr_err("alg: %s: %s overran result buffer on test vector %s, cfg=\"%s\"\n",
1152 		       type, driver, vec_name, cfg->name);
1153 		return -EOVERFLOW;
1154 	}
1155 	return 0;
1156 }
1157 
1158 static inline int check_shash_op(const char *op, int err,
1159 				 const char *driver, const char *vec_name,
1160 				 const struct testvec_config *cfg)
1161 {
1162 	if (err)
1163 		pr_err("alg: shash: %s %s() failed with err %d on test vector %s, cfg=\"%s\"\n",
1164 		       driver, op, err, vec_name, cfg->name);
1165 	return err;
1166 }
1167 
1168 /* Test one hash test vector in one configuration, using the shash API */
1169 static int test_shash_vec_cfg(const struct hash_testvec *vec,
1170 			      const char *vec_name,
1171 			      const struct testvec_config *cfg,
1172 			      struct shash_desc *desc,
1173 			      struct test_sglist *tsgl,
1174 			      u8 *hashstate)
1175 {
1176 	struct crypto_shash *tfm = desc->tfm;
1177 	const unsigned int alignmask = crypto_shash_alignmask(tfm);
1178 	const unsigned int digestsize = crypto_shash_digestsize(tfm);
1179 	const unsigned int statesize = crypto_shash_statesize(tfm);
1180 	const char *driver = crypto_shash_driver_name(tfm);
1181 	const struct test_sg_division *divs[XBUFSIZE];
1182 	unsigned int i;
1183 	u8 result[HASH_MAX_DIGESTSIZE + TESTMGR_POISON_LEN];
1184 	int err;
1185 
1186 	/* Set the key, if specified */
1187 	if (vec->ksize) {
1188 		err = do_setkey(crypto_shash_setkey, tfm, vec->key, vec->ksize,
1189 				cfg, alignmask);
1190 		if (err) {
1191 			if (err == vec->setkey_error)
1192 				return 0;
1193 			pr_err("alg: shash: %s setkey failed on test vector %s; expected_error=%d, actual_error=%d, flags=%#x\n",
1194 			       driver, vec_name, vec->setkey_error, err,
1195 			       crypto_shash_get_flags(tfm));
1196 			return err;
1197 		}
1198 		if (vec->setkey_error) {
1199 			pr_err("alg: shash: %s setkey unexpectedly succeeded on test vector %s; expected_error=%d\n",
1200 			       driver, vec_name, vec->setkey_error);
1201 			return -EINVAL;
1202 		}
1203 	}
1204 
1205 	/* Build the scatterlist for the source data */
1206 	err = build_hash_sglist(tsgl, vec, cfg, alignmask, divs);
1207 	if (err) {
1208 		pr_err("alg: shash: %s: error preparing scatterlist for test vector %s, cfg=\"%s\"\n",
1209 		       driver, vec_name, cfg->name);
1210 		return err;
1211 	}
1212 
1213 	/* Do the actual hashing */
1214 
1215 	testmgr_poison(desc->__ctx, crypto_shash_descsize(tfm));
1216 	testmgr_poison(result, digestsize + TESTMGR_POISON_LEN);
1217 
1218 	if (cfg->finalization_type == FINALIZATION_TYPE_DIGEST ||
1219 	    vec->digest_error) {
1220 		/* Just using digest() */
1221 		if (tsgl->nents != 1)
1222 			return 0;
1223 		if (cfg->nosimd)
1224 			crypto_disable_simd_for_test();
1225 		err = crypto_shash_digest(desc, sg_virt(&tsgl->sgl[0]),
1226 					  tsgl->sgl[0].length, result);
1227 		if (cfg->nosimd)
1228 			crypto_reenable_simd_for_test();
1229 		if (err) {
1230 			if (err == vec->digest_error)
1231 				return 0;
1232 			pr_err("alg: shash: %s digest() failed on test vector %s; expected_error=%d, actual_error=%d, cfg=\"%s\"\n",
1233 			       driver, vec_name, vec->digest_error, err,
1234 			       cfg->name);
1235 			return err;
1236 		}
1237 		if (vec->digest_error) {
1238 			pr_err("alg: shash: %s digest() unexpectedly succeeded on test vector %s; expected_error=%d, cfg=\"%s\"\n",
1239 			       driver, vec_name, vec->digest_error, cfg->name);
1240 			return -EINVAL;
1241 		}
1242 		goto result_ready;
1243 	}
1244 
1245 	/* Using init(), zero or more update(), then final() or finup() */
1246 
1247 	if (cfg->nosimd)
1248 		crypto_disable_simd_for_test();
1249 	err = crypto_shash_init(desc);
1250 	if (cfg->nosimd)
1251 		crypto_reenable_simd_for_test();
1252 	err = check_shash_op("init", err, driver, vec_name, cfg);
1253 	if (err)
1254 		return err;
1255 
1256 	for (i = 0; i < tsgl->nents; i++) {
1257 		if (i + 1 == tsgl->nents &&
1258 		    cfg->finalization_type == FINALIZATION_TYPE_FINUP) {
1259 			if (divs[i]->nosimd)
1260 				crypto_disable_simd_for_test();
1261 			err = crypto_shash_finup(desc, sg_virt(&tsgl->sgl[i]),
1262 						 tsgl->sgl[i].length, result);
1263 			if (divs[i]->nosimd)
1264 				crypto_reenable_simd_for_test();
1265 			err = check_shash_op("finup", err, driver, vec_name,
1266 					     cfg);
1267 			if (err)
1268 				return err;
1269 			goto result_ready;
1270 		}
1271 		if (divs[i]->nosimd)
1272 			crypto_disable_simd_for_test();
1273 		err = crypto_shash_update(desc, sg_virt(&tsgl->sgl[i]),
1274 					  tsgl->sgl[i].length);
1275 		if (divs[i]->nosimd)
1276 			crypto_reenable_simd_for_test();
1277 		err = check_shash_op("update", err, driver, vec_name, cfg);
1278 		if (err)
1279 			return err;
1280 		if (divs[i]->flush_type == FLUSH_TYPE_REIMPORT) {
1281 			/* Test ->export() and ->import() */
1282 			testmgr_poison(hashstate + statesize,
1283 				       TESTMGR_POISON_LEN);
1284 			err = crypto_shash_export(desc, hashstate);
1285 			err = check_shash_op("export", err, driver, vec_name,
1286 					     cfg);
1287 			if (err)
1288 				return err;
1289 			if (!testmgr_is_poison(hashstate + statesize,
1290 					       TESTMGR_POISON_LEN)) {
1291 				pr_err("alg: shash: %s export() overran state buffer on test vector %s, cfg=\"%s\"\n",
1292 				       driver, vec_name, cfg->name);
1293 				return -EOVERFLOW;
1294 			}
1295 			testmgr_poison(desc->__ctx, crypto_shash_descsize(tfm));
1296 			err = crypto_shash_import(desc, hashstate);
1297 			err = check_shash_op("import", err, driver, vec_name,
1298 					     cfg);
1299 			if (err)
1300 				return err;
1301 		}
1302 	}
1303 
1304 	if (cfg->nosimd)
1305 		crypto_disable_simd_for_test();
1306 	err = crypto_shash_final(desc, result);
1307 	if (cfg->nosimd)
1308 		crypto_reenable_simd_for_test();
1309 	err = check_shash_op("final", err, driver, vec_name, cfg);
1310 	if (err)
1311 		return err;
1312 result_ready:
1313 	return check_hash_result("shash", result, digestsize, vec, vec_name,
1314 				 driver, cfg);
1315 }
1316 
1317 static int do_ahash_op(int (*op)(struct ahash_request *req),
1318 		       struct ahash_request *req,
1319 		       struct crypto_wait *wait, bool nosimd)
1320 {
1321 	int err;
1322 
1323 	if (nosimd)
1324 		crypto_disable_simd_for_test();
1325 
1326 	err = op(req);
1327 
1328 	if (nosimd)
1329 		crypto_reenable_simd_for_test();
1330 
1331 	return crypto_wait_req(err, wait);
1332 }
1333 
1334 static int check_nonfinal_ahash_op(const char *op, int err,
1335 				   u8 *result, unsigned int digestsize,
1336 				   const char *driver, const char *vec_name,
1337 				   const struct testvec_config *cfg)
1338 {
1339 	if (err) {
1340 		pr_err("alg: ahash: %s %s() failed with err %d on test vector %s, cfg=\"%s\"\n",
1341 		       driver, op, err, vec_name, cfg->name);
1342 		return err;
1343 	}
1344 	if (!testmgr_is_poison(result, digestsize)) {
1345 		pr_err("alg: ahash: %s %s() used result buffer on test vector %s, cfg=\"%s\"\n",
1346 		       driver, op, vec_name, cfg->name);
1347 		return -EINVAL;
1348 	}
1349 	return 0;
1350 }
1351 
1352 /* Test one hash test vector in one configuration, using the ahash API */
1353 static int test_ahash_vec_cfg(const struct hash_testvec *vec,
1354 			      const char *vec_name,
1355 			      const struct testvec_config *cfg,
1356 			      struct ahash_request *req,
1357 			      struct test_sglist *tsgl,
1358 			      u8 *hashstate)
1359 {
1360 	struct crypto_ahash *tfm = crypto_ahash_reqtfm(req);
1361 	const unsigned int alignmask = crypto_ahash_alignmask(tfm);
1362 	const unsigned int digestsize = crypto_ahash_digestsize(tfm);
1363 	const unsigned int statesize = crypto_ahash_statesize(tfm);
1364 	const char *driver = crypto_ahash_driver_name(tfm);
1365 	const u32 req_flags = CRYPTO_TFM_REQ_MAY_BACKLOG | cfg->req_flags;
1366 	const struct test_sg_division *divs[XBUFSIZE];
1367 	DECLARE_CRYPTO_WAIT(wait);
1368 	unsigned int i;
1369 	struct scatterlist *pending_sgl;
1370 	unsigned int pending_len;
1371 	u8 result[HASH_MAX_DIGESTSIZE + TESTMGR_POISON_LEN];
1372 	int err;
1373 
1374 	/* Set the key, if specified */
1375 	if (vec->ksize) {
1376 		err = do_setkey(crypto_ahash_setkey, tfm, vec->key, vec->ksize,
1377 				cfg, alignmask);
1378 		if (err) {
1379 			if (err == vec->setkey_error)
1380 				return 0;
1381 			pr_err("alg: ahash: %s setkey failed on test vector %s; expected_error=%d, actual_error=%d, flags=%#x\n",
1382 			       driver, vec_name, vec->setkey_error, err,
1383 			       crypto_ahash_get_flags(tfm));
1384 			return err;
1385 		}
1386 		if (vec->setkey_error) {
1387 			pr_err("alg: ahash: %s setkey unexpectedly succeeded on test vector %s; expected_error=%d\n",
1388 			       driver, vec_name, vec->setkey_error);
1389 			return -EINVAL;
1390 		}
1391 	}
1392 
1393 	/* Build the scatterlist for the source data */
1394 	err = build_hash_sglist(tsgl, vec, cfg, alignmask, divs);
1395 	if (err) {
1396 		pr_err("alg: ahash: %s: error preparing scatterlist for test vector %s, cfg=\"%s\"\n",
1397 		       driver, vec_name, cfg->name);
1398 		return err;
1399 	}
1400 
1401 	/* Do the actual hashing */
1402 
1403 	testmgr_poison(req->__ctx, crypto_ahash_reqsize(tfm));
1404 	testmgr_poison(result, digestsize + TESTMGR_POISON_LEN);
1405 
1406 	if (cfg->finalization_type == FINALIZATION_TYPE_DIGEST ||
1407 	    vec->digest_error) {
1408 		/* Just using digest() */
1409 		ahash_request_set_callback(req, req_flags, crypto_req_done,
1410 					   &wait);
1411 		ahash_request_set_crypt(req, tsgl->sgl, result, vec->psize);
1412 		err = do_ahash_op(crypto_ahash_digest, req, &wait, cfg->nosimd);
1413 		if (err) {
1414 			if (err == vec->digest_error)
1415 				return 0;
1416 			pr_err("alg: ahash: %s digest() failed on test vector %s; expected_error=%d, actual_error=%d, cfg=\"%s\"\n",
1417 			       driver, vec_name, vec->digest_error, err,
1418 			       cfg->name);
1419 			return err;
1420 		}
1421 		if (vec->digest_error) {
1422 			pr_err("alg: ahash: %s digest() unexpectedly succeeded on test vector %s; expected_error=%d, cfg=\"%s\"\n",
1423 			       driver, vec_name, vec->digest_error, cfg->name);
1424 			return -EINVAL;
1425 		}
1426 		goto result_ready;
1427 	}
1428 
1429 	/* Using init(), zero or more update(), then final() or finup() */
1430 
1431 	ahash_request_set_callback(req, req_flags, crypto_req_done, &wait);
1432 	ahash_request_set_crypt(req, NULL, result, 0);
1433 	err = do_ahash_op(crypto_ahash_init, req, &wait, cfg->nosimd);
1434 	err = check_nonfinal_ahash_op("init", err, result, digestsize,
1435 				      driver, vec_name, cfg);
1436 	if (err)
1437 		return err;
1438 
1439 	pending_sgl = NULL;
1440 	pending_len = 0;
1441 	for (i = 0; i < tsgl->nents; i++) {
1442 		if (divs[i]->flush_type != FLUSH_TYPE_NONE &&
1443 		    pending_sgl != NULL) {
1444 			/* update() with the pending data */
1445 			ahash_request_set_callback(req, req_flags,
1446 						   crypto_req_done, &wait);
1447 			ahash_request_set_crypt(req, pending_sgl, result,
1448 						pending_len);
1449 			err = do_ahash_op(crypto_ahash_update, req, &wait,
1450 					  divs[i]->nosimd);
1451 			err = check_nonfinal_ahash_op("update", err,
1452 						      result, digestsize,
1453 						      driver, vec_name, cfg);
1454 			if (err)
1455 				return err;
1456 			pending_sgl = NULL;
1457 			pending_len = 0;
1458 		}
1459 		if (divs[i]->flush_type == FLUSH_TYPE_REIMPORT) {
1460 			/* Test ->export() and ->import() */
1461 			testmgr_poison(hashstate + statesize,
1462 				       TESTMGR_POISON_LEN);
1463 			err = crypto_ahash_export(req, hashstate);
1464 			err = check_nonfinal_ahash_op("export", err,
1465 						      result, digestsize,
1466 						      driver, vec_name, cfg);
1467 			if (err)
1468 				return err;
1469 			if (!testmgr_is_poison(hashstate + statesize,
1470 					       TESTMGR_POISON_LEN)) {
1471 				pr_err("alg: ahash: %s export() overran state buffer on test vector %s, cfg=\"%s\"\n",
1472 				       driver, vec_name, cfg->name);
1473 				return -EOVERFLOW;
1474 			}
1475 
1476 			testmgr_poison(req->__ctx, crypto_ahash_reqsize(tfm));
1477 			err = crypto_ahash_import(req, hashstate);
1478 			err = check_nonfinal_ahash_op("import", err,
1479 						      result, digestsize,
1480 						      driver, vec_name, cfg);
1481 			if (err)
1482 				return err;
1483 		}
1484 		if (pending_sgl == NULL)
1485 			pending_sgl = &tsgl->sgl[i];
1486 		pending_len += tsgl->sgl[i].length;
1487 	}
1488 
1489 	ahash_request_set_callback(req, req_flags, crypto_req_done, &wait);
1490 	ahash_request_set_crypt(req, pending_sgl, result, pending_len);
1491 	if (cfg->finalization_type == FINALIZATION_TYPE_FINAL) {
1492 		/* finish with update() and final() */
1493 		err = do_ahash_op(crypto_ahash_update, req, &wait, cfg->nosimd);
1494 		err = check_nonfinal_ahash_op("update", err, result, digestsize,
1495 					      driver, vec_name, cfg);
1496 		if (err)
1497 			return err;
1498 		err = do_ahash_op(crypto_ahash_final, req, &wait, cfg->nosimd);
1499 		if (err) {
1500 			pr_err("alg: ahash: %s final() failed with err %d on test vector %s, cfg=\"%s\"\n",
1501 			       driver, err, vec_name, cfg->name);
1502 			return err;
1503 		}
1504 	} else {
1505 		/* finish with finup() */
1506 		err = do_ahash_op(crypto_ahash_finup, req, &wait, cfg->nosimd);
1507 		if (err) {
1508 			pr_err("alg: ahash: %s finup() failed with err %d on test vector %s, cfg=\"%s\"\n",
1509 			       driver, err, vec_name, cfg->name);
1510 			return err;
1511 		}
1512 	}
1513 
1514 result_ready:
1515 	return check_hash_result("ahash", result, digestsize, vec, vec_name,
1516 				 driver, cfg);
1517 }
1518 
1519 static int test_hash_vec_cfg(const struct hash_testvec *vec,
1520 			     const char *vec_name,
1521 			     const struct testvec_config *cfg,
1522 			     struct ahash_request *req,
1523 			     struct shash_desc *desc,
1524 			     struct test_sglist *tsgl,
1525 			     u8 *hashstate)
1526 {
1527 	int err;
1528 
1529 	/*
1530 	 * For algorithms implemented as "shash", most bugs will be detected by
1531 	 * both the shash and ahash tests.  Test the shash API first so that the
1532 	 * failures involve less indirection, so are easier to debug.
1533 	 */
1534 
1535 	if (desc) {
1536 		err = test_shash_vec_cfg(vec, vec_name, cfg, desc, tsgl,
1537 					 hashstate);
1538 		if (err)
1539 			return err;
1540 	}
1541 
1542 	return test_ahash_vec_cfg(vec, vec_name, cfg, req, tsgl, hashstate);
1543 }
1544 
1545 static int test_hash_vec(const struct hash_testvec *vec, unsigned int vec_num,
1546 			 struct ahash_request *req, struct shash_desc *desc,
1547 			 struct test_sglist *tsgl, u8 *hashstate)
1548 {
1549 	char vec_name[16];
1550 	unsigned int i;
1551 	int err;
1552 
1553 	sprintf(vec_name, "%u", vec_num);
1554 
1555 	for (i = 0; i < ARRAY_SIZE(default_hash_testvec_configs); i++) {
1556 		err = test_hash_vec_cfg(vec, vec_name,
1557 					&default_hash_testvec_configs[i],
1558 					req, desc, tsgl, hashstate);
1559 		if (err)
1560 			return err;
1561 	}
1562 
1563 #ifdef CONFIG_CRYPTO_MANAGER_EXTRA_TESTS
1564 	if (!noextratests) {
1565 		struct testvec_config cfg;
1566 		char cfgname[TESTVEC_CONFIG_NAMELEN];
1567 
1568 		for (i = 0; i < fuzz_iterations; i++) {
1569 			generate_random_testvec_config(&cfg, cfgname,
1570 						       sizeof(cfgname));
1571 			err = test_hash_vec_cfg(vec, vec_name, &cfg,
1572 						req, desc, tsgl, hashstate);
1573 			if (err)
1574 				return err;
1575 			cond_resched();
1576 		}
1577 	}
1578 #endif
1579 	return 0;
1580 }
1581 
1582 #ifdef CONFIG_CRYPTO_MANAGER_EXTRA_TESTS
1583 /*
1584  * Generate a hash test vector from the given implementation.
1585  * Assumes the buffers in 'vec' were already allocated.
1586  */
1587 static void generate_random_hash_testvec(struct shash_desc *desc,
1588 					 struct hash_testvec *vec,
1589 					 unsigned int maxkeysize,
1590 					 unsigned int maxdatasize,
1591 					 char *name, size_t max_namelen)
1592 {
1593 	/* Data */
1594 	vec->psize = generate_random_length(maxdatasize);
1595 	generate_random_bytes((u8 *)vec->plaintext, vec->psize);
1596 
1597 	/*
1598 	 * Key: length in range [1, maxkeysize], but usually choose maxkeysize.
1599 	 * If algorithm is unkeyed, then maxkeysize == 0 and set ksize = 0.
1600 	 */
1601 	vec->setkey_error = 0;
1602 	vec->ksize = 0;
1603 	if (maxkeysize) {
1604 		vec->ksize = maxkeysize;
1605 		if (prandom_u32() % 4 == 0)
1606 			vec->ksize = 1 + (prandom_u32() % maxkeysize);
1607 		generate_random_bytes((u8 *)vec->key, vec->ksize);
1608 
1609 		vec->setkey_error = crypto_shash_setkey(desc->tfm, vec->key,
1610 							vec->ksize);
1611 		/* If the key couldn't be set, no need to continue to digest. */
1612 		if (vec->setkey_error)
1613 			goto done;
1614 	}
1615 
1616 	/* Digest */
1617 	vec->digest_error = crypto_shash_digest(desc, vec->plaintext,
1618 						vec->psize, (u8 *)vec->digest);
1619 done:
1620 	snprintf(name, max_namelen, "\"random: psize=%u ksize=%u\"",
1621 		 vec->psize, vec->ksize);
1622 }
1623 
1624 /*
1625  * Test the hash algorithm represented by @req against the corresponding generic
1626  * implementation, if one is available.
1627  */
1628 static int test_hash_vs_generic_impl(const char *generic_driver,
1629 				     unsigned int maxkeysize,
1630 				     struct ahash_request *req,
1631 				     struct shash_desc *desc,
1632 				     struct test_sglist *tsgl,
1633 				     u8 *hashstate)
1634 {
1635 	struct crypto_ahash *tfm = crypto_ahash_reqtfm(req);
1636 	const unsigned int digestsize = crypto_ahash_digestsize(tfm);
1637 	const unsigned int blocksize = crypto_ahash_blocksize(tfm);
1638 	const unsigned int maxdatasize = (2 * PAGE_SIZE) - TESTMGR_POISON_LEN;
1639 	const char *algname = crypto_hash_alg_common(tfm)->base.cra_name;
1640 	const char *driver = crypto_ahash_driver_name(tfm);
1641 	char _generic_driver[CRYPTO_MAX_ALG_NAME];
1642 	struct crypto_shash *generic_tfm = NULL;
1643 	struct shash_desc *generic_desc = NULL;
1644 	unsigned int i;
1645 	struct hash_testvec vec = { 0 };
1646 	char vec_name[64];
1647 	struct testvec_config *cfg;
1648 	char cfgname[TESTVEC_CONFIG_NAMELEN];
1649 	int err;
1650 
1651 	if (noextratests)
1652 		return 0;
1653 
1654 	if (!generic_driver) { /* Use default naming convention? */
1655 		err = build_generic_driver_name(algname, _generic_driver);
1656 		if (err)
1657 			return err;
1658 		generic_driver = _generic_driver;
1659 	}
1660 
1661 	if (strcmp(generic_driver, driver) == 0) /* Already the generic impl? */
1662 		return 0;
1663 
1664 	generic_tfm = crypto_alloc_shash(generic_driver, 0, 0);
1665 	if (IS_ERR(generic_tfm)) {
1666 		err = PTR_ERR(generic_tfm);
1667 		if (err == -ENOENT) {
1668 			pr_warn("alg: hash: skipping comparison tests for %s because %s is unavailable\n",
1669 				driver, generic_driver);
1670 			return 0;
1671 		}
1672 		pr_err("alg: hash: error allocating %s (generic impl of %s): %d\n",
1673 		       generic_driver, algname, err);
1674 		return err;
1675 	}
1676 
1677 	cfg = kzalloc(sizeof(*cfg), GFP_KERNEL);
1678 	if (!cfg) {
1679 		err = -ENOMEM;
1680 		goto out;
1681 	}
1682 
1683 	generic_desc = kzalloc(sizeof(*desc) +
1684 			       crypto_shash_descsize(generic_tfm), GFP_KERNEL);
1685 	if (!generic_desc) {
1686 		err = -ENOMEM;
1687 		goto out;
1688 	}
1689 	generic_desc->tfm = generic_tfm;
1690 
1691 	/* Check the algorithm properties for consistency. */
1692 
1693 	if (digestsize != crypto_shash_digestsize(generic_tfm)) {
1694 		pr_err("alg: hash: digestsize for %s (%u) doesn't match generic impl (%u)\n",
1695 		       driver, digestsize,
1696 		       crypto_shash_digestsize(generic_tfm));
1697 		err = -EINVAL;
1698 		goto out;
1699 	}
1700 
1701 	if (blocksize != crypto_shash_blocksize(generic_tfm)) {
1702 		pr_err("alg: hash: blocksize for %s (%u) doesn't match generic impl (%u)\n",
1703 		       driver, blocksize, crypto_shash_blocksize(generic_tfm));
1704 		err = -EINVAL;
1705 		goto out;
1706 	}
1707 
1708 	/*
1709 	 * Now generate test vectors using the generic implementation, and test
1710 	 * the other implementation against them.
1711 	 */
1712 
1713 	vec.key = kmalloc(maxkeysize, GFP_KERNEL);
1714 	vec.plaintext = kmalloc(maxdatasize, GFP_KERNEL);
1715 	vec.digest = kmalloc(digestsize, GFP_KERNEL);
1716 	if (!vec.key || !vec.plaintext || !vec.digest) {
1717 		err = -ENOMEM;
1718 		goto out;
1719 	}
1720 
1721 	for (i = 0; i < fuzz_iterations * 8; i++) {
1722 		generate_random_hash_testvec(generic_desc, &vec,
1723 					     maxkeysize, maxdatasize,
1724 					     vec_name, sizeof(vec_name));
1725 		generate_random_testvec_config(cfg, cfgname, sizeof(cfgname));
1726 
1727 		err = test_hash_vec_cfg(&vec, vec_name, cfg,
1728 					req, desc, tsgl, hashstate);
1729 		if (err)
1730 			goto out;
1731 		cond_resched();
1732 	}
1733 	err = 0;
1734 out:
1735 	kfree(cfg);
1736 	kfree(vec.key);
1737 	kfree(vec.plaintext);
1738 	kfree(vec.digest);
1739 	crypto_free_shash(generic_tfm);
1740 	kfree_sensitive(generic_desc);
1741 	return err;
1742 }
1743 #else /* !CONFIG_CRYPTO_MANAGER_EXTRA_TESTS */
1744 static int test_hash_vs_generic_impl(const char *generic_driver,
1745 				     unsigned int maxkeysize,
1746 				     struct ahash_request *req,
1747 				     struct shash_desc *desc,
1748 				     struct test_sglist *tsgl,
1749 				     u8 *hashstate)
1750 {
1751 	return 0;
1752 }
1753 #endif /* !CONFIG_CRYPTO_MANAGER_EXTRA_TESTS */
1754 
1755 static int alloc_shash(const char *driver, u32 type, u32 mask,
1756 		       struct crypto_shash **tfm_ret,
1757 		       struct shash_desc **desc_ret)
1758 {
1759 	struct crypto_shash *tfm;
1760 	struct shash_desc *desc;
1761 
1762 	tfm = crypto_alloc_shash(driver, type, mask);
1763 	if (IS_ERR(tfm)) {
1764 		if (PTR_ERR(tfm) == -ENOENT) {
1765 			/*
1766 			 * This algorithm is only available through the ahash
1767 			 * API, not the shash API, so skip the shash tests.
1768 			 */
1769 			return 0;
1770 		}
1771 		pr_err("alg: hash: failed to allocate shash transform for %s: %ld\n",
1772 		       driver, PTR_ERR(tfm));
1773 		return PTR_ERR(tfm);
1774 	}
1775 
1776 	desc = kmalloc(sizeof(*desc) + crypto_shash_descsize(tfm), GFP_KERNEL);
1777 	if (!desc) {
1778 		crypto_free_shash(tfm);
1779 		return -ENOMEM;
1780 	}
1781 	desc->tfm = tfm;
1782 
1783 	*tfm_ret = tfm;
1784 	*desc_ret = desc;
1785 	return 0;
1786 }
1787 
1788 static int __alg_test_hash(const struct hash_testvec *vecs,
1789 			   unsigned int num_vecs, const char *driver,
1790 			   u32 type, u32 mask,
1791 			   const char *generic_driver, unsigned int maxkeysize)
1792 {
1793 	struct crypto_ahash *atfm = NULL;
1794 	struct ahash_request *req = NULL;
1795 	struct crypto_shash *stfm = NULL;
1796 	struct shash_desc *desc = NULL;
1797 	struct test_sglist *tsgl = NULL;
1798 	u8 *hashstate = NULL;
1799 	unsigned int statesize;
1800 	unsigned int i;
1801 	int err;
1802 
1803 	/*
1804 	 * Always test the ahash API.  This works regardless of whether the
1805 	 * algorithm is implemented as ahash or shash.
1806 	 */
1807 
1808 	atfm = crypto_alloc_ahash(driver, type, mask);
1809 	if (IS_ERR(atfm)) {
1810 		pr_err("alg: hash: failed to allocate transform for %s: %ld\n",
1811 		       driver, PTR_ERR(atfm));
1812 		return PTR_ERR(atfm);
1813 	}
1814 	driver = crypto_ahash_driver_name(atfm);
1815 
1816 	req = ahash_request_alloc(atfm, GFP_KERNEL);
1817 	if (!req) {
1818 		pr_err("alg: hash: failed to allocate request for %s\n",
1819 		       driver);
1820 		err = -ENOMEM;
1821 		goto out;
1822 	}
1823 
1824 	/*
1825 	 * If available also test the shash API, to cover corner cases that may
1826 	 * be missed by testing the ahash API only.
1827 	 */
1828 	err = alloc_shash(driver, type, mask, &stfm, &desc);
1829 	if (err)
1830 		goto out;
1831 
1832 	tsgl = kmalloc(sizeof(*tsgl), GFP_KERNEL);
1833 	if (!tsgl || init_test_sglist(tsgl) != 0) {
1834 		pr_err("alg: hash: failed to allocate test buffers for %s\n",
1835 		       driver);
1836 		kfree(tsgl);
1837 		tsgl = NULL;
1838 		err = -ENOMEM;
1839 		goto out;
1840 	}
1841 
1842 	statesize = crypto_ahash_statesize(atfm);
1843 	if (stfm)
1844 		statesize = max(statesize, crypto_shash_statesize(stfm));
1845 	hashstate = kmalloc(statesize + TESTMGR_POISON_LEN, GFP_KERNEL);
1846 	if (!hashstate) {
1847 		pr_err("alg: hash: failed to allocate hash state buffer for %s\n",
1848 		       driver);
1849 		err = -ENOMEM;
1850 		goto out;
1851 	}
1852 
1853 	for (i = 0; i < num_vecs; i++) {
1854 		if (fips_enabled && vecs[i].fips_skip)
1855 			continue;
1856 
1857 		err = test_hash_vec(&vecs[i], i, req, desc, tsgl, hashstate);
1858 		if (err)
1859 			goto out;
1860 		cond_resched();
1861 	}
1862 	err = test_hash_vs_generic_impl(generic_driver, maxkeysize, req,
1863 					desc, tsgl, hashstate);
1864 out:
1865 	kfree(hashstate);
1866 	if (tsgl) {
1867 		destroy_test_sglist(tsgl);
1868 		kfree(tsgl);
1869 	}
1870 	kfree(desc);
1871 	crypto_free_shash(stfm);
1872 	ahash_request_free(req);
1873 	crypto_free_ahash(atfm);
1874 	return err;
1875 }
1876 
1877 static int alg_test_hash(const struct alg_test_desc *desc, const char *driver,
1878 			 u32 type, u32 mask)
1879 {
1880 	const struct hash_testvec *template = desc->suite.hash.vecs;
1881 	unsigned int tcount = desc->suite.hash.count;
1882 	unsigned int nr_unkeyed, nr_keyed;
1883 	unsigned int maxkeysize = 0;
1884 	int err;
1885 
1886 	/*
1887 	 * For OPTIONAL_KEY algorithms, we have to do all the unkeyed tests
1888 	 * first, before setting a key on the tfm.  To make this easier, we
1889 	 * require that the unkeyed test vectors (if any) are listed first.
1890 	 */
1891 
1892 	for (nr_unkeyed = 0; nr_unkeyed < tcount; nr_unkeyed++) {
1893 		if (template[nr_unkeyed].ksize)
1894 			break;
1895 	}
1896 	for (nr_keyed = 0; nr_unkeyed + nr_keyed < tcount; nr_keyed++) {
1897 		if (!template[nr_unkeyed + nr_keyed].ksize) {
1898 			pr_err("alg: hash: test vectors for %s out of order, "
1899 			       "unkeyed ones must come first\n", desc->alg);
1900 			return -EINVAL;
1901 		}
1902 		maxkeysize = max_t(unsigned int, maxkeysize,
1903 				   template[nr_unkeyed + nr_keyed].ksize);
1904 	}
1905 
1906 	err = 0;
1907 	if (nr_unkeyed) {
1908 		err = __alg_test_hash(template, nr_unkeyed, driver, type, mask,
1909 				      desc->generic_driver, maxkeysize);
1910 		template += nr_unkeyed;
1911 	}
1912 
1913 	if (!err && nr_keyed)
1914 		err = __alg_test_hash(template, nr_keyed, driver, type, mask,
1915 				      desc->generic_driver, maxkeysize);
1916 
1917 	return err;
1918 }
1919 
1920 static int test_aead_vec_cfg(int enc, const struct aead_testvec *vec,
1921 			     const char *vec_name,
1922 			     const struct testvec_config *cfg,
1923 			     struct aead_request *req,
1924 			     struct cipher_test_sglists *tsgls)
1925 {
1926 	struct crypto_aead *tfm = crypto_aead_reqtfm(req);
1927 	const unsigned int alignmask = crypto_aead_alignmask(tfm);
1928 	const unsigned int ivsize = crypto_aead_ivsize(tfm);
1929 	const unsigned int authsize = vec->clen - vec->plen;
1930 	const char *driver = crypto_aead_driver_name(tfm);
1931 	const u32 req_flags = CRYPTO_TFM_REQ_MAY_BACKLOG | cfg->req_flags;
1932 	const char *op = enc ? "encryption" : "decryption";
1933 	DECLARE_CRYPTO_WAIT(wait);
1934 	u8 _iv[3 * (MAX_ALGAPI_ALIGNMASK + 1) + MAX_IVLEN];
1935 	u8 *iv = PTR_ALIGN(&_iv[0], 2 * (MAX_ALGAPI_ALIGNMASK + 1)) +
1936 		 cfg->iv_offset +
1937 		 (cfg->iv_offset_relative_to_alignmask ? alignmask : 0);
1938 	struct kvec input[2];
1939 	int err;
1940 
1941 	/* Set the key */
1942 	if (vec->wk)
1943 		crypto_aead_set_flags(tfm, CRYPTO_TFM_REQ_FORBID_WEAK_KEYS);
1944 	else
1945 		crypto_aead_clear_flags(tfm, CRYPTO_TFM_REQ_FORBID_WEAK_KEYS);
1946 
1947 	err = do_setkey(crypto_aead_setkey, tfm, vec->key, vec->klen,
1948 			cfg, alignmask);
1949 	if (err && err != vec->setkey_error) {
1950 		pr_err("alg: aead: %s setkey failed on test vector %s; expected_error=%d, actual_error=%d, flags=%#x\n",
1951 		       driver, vec_name, vec->setkey_error, err,
1952 		       crypto_aead_get_flags(tfm));
1953 		return err;
1954 	}
1955 	if (!err && vec->setkey_error) {
1956 		pr_err("alg: aead: %s setkey unexpectedly succeeded on test vector %s; expected_error=%d\n",
1957 		       driver, vec_name, vec->setkey_error);
1958 		return -EINVAL;
1959 	}
1960 
1961 	/* Set the authentication tag size */
1962 	err = crypto_aead_setauthsize(tfm, authsize);
1963 	if (err && err != vec->setauthsize_error) {
1964 		pr_err("alg: aead: %s setauthsize failed on test vector %s; expected_error=%d, actual_error=%d\n",
1965 		       driver, vec_name, vec->setauthsize_error, err);
1966 		return err;
1967 	}
1968 	if (!err && vec->setauthsize_error) {
1969 		pr_err("alg: aead: %s setauthsize unexpectedly succeeded on test vector %s; expected_error=%d\n",
1970 		       driver, vec_name, vec->setauthsize_error);
1971 		return -EINVAL;
1972 	}
1973 
1974 	if (vec->setkey_error || vec->setauthsize_error)
1975 		return 0;
1976 
1977 	/* The IV must be copied to a buffer, as the algorithm may modify it */
1978 	if (WARN_ON(ivsize > MAX_IVLEN))
1979 		return -EINVAL;
1980 	if (vec->iv)
1981 		memcpy(iv, vec->iv, ivsize);
1982 	else
1983 		memset(iv, 0, ivsize);
1984 
1985 	/* Build the src/dst scatterlists */
1986 	input[0].iov_base = (void *)vec->assoc;
1987 	input[0].iov_len = vec->alen;
1988 	input[1].iov_base = enc ? (void *)vec->ptext : (void *)vec->ctext;
1989 	input[1].iov_len = enc ? vec->plen : vec->clen;
1990 	err = build_cipher_test_sglists(tsgls, cfg, alignmask,
1991 					vec->alen + (enc ? vec->plen :
1992 						     vec->clen),
1993 					vec->alen + (enc ? vec->clen :
1994 						     vec->plen),
1995 					input, 2);
1996 	if (err) {
1997 		pr_err("alg: aead: %s %s: error preparing scatterlists for test vector %s, cfg=\"%s\"\n",
1998 		       driver, op, vec_name, cfg->name);
1999 		return err;
2000 	}
2001 
2002 	/* Do the actual encryption or decryption */
2003 	testmgr_poison(req->__ctx, crypto_aead_reqsize(tfm));
2004 	aead_request_set_callback(req, req_flags, crypto_req_done, &wait);
2005 	aead_request_set_crypt(req, tsgls->src.sgl_ptr, tsgls->dst.sgl_ptr,
2006 			       enc ? vec->plen : vec->clen, iv);
2007 	aead_request_set_ad(req, vec->alen);
2008 	if (cfg->nosimd)
2009 		crypto_disable_simd_for_test();
2010 	err = enc ? crypto_aead_encrypt(req) : crypto_aead_decrypt(req);
2011 	if (cfg->nosimd)
2012 		crypto_reenable_simd_for_test();
2013 	err = crypto_wait_req(err, &wait);
2014 
2015 	/* Check that the algorithm didn't overwrite things it shouldn't have */
2016 	if (req->cryptlen != (enc ? vec->plen : vec->clen) ||
2017 	    req->assoclen != vec->alen ||
2018 	    req->iv != iv ||
2019 	    req->src != tsgls->src.sgl_ptr ||
2020 	    req->dst != tsgls->dst.sgl_ptr ||
2021 	    crypto_aead_reqtfm(req) != tfm ||
2022 	    req->base.complete != crypto_req_done ||
2023 	    req->base.flags != req_flags ||
2024 	    req->base.data != &wait) {
2025 		pr_err("alg: aead: %s %s corrupted request struct on test vector %s, cfg=\"%s\"\n",
2026 		       driver, op, vec_name, cfg->name);
2027 		if (req->cryptlen != (enc ? vec->plen : vec->clen))
2028 			pr_err("alg: aead: changed 'req->cryptlen'\n");
2029 		if (req->assoclen != vec->alen)
2030 			pr_err("alg: aead: changed 'req->assoclen'\n");
2031 		if (req->iv != iv)
2032 			pr_err("alg: aead: changed 'req->iv'\n");
2033 		if (req->src != tsgls->src.sgl_ptr)
2034 			pr_err("alg: aead: changed 'req->src'\n");
2035 		if (req->dst != tsgls->dst.sgl_ptr)
2036 			pr_err("alg: aead: changed 'req->dst'\n");
2037 		if (crypto_aead_reqtfm(req) != tfm)
2038 			pr_err("alg: aead: changed 'req->base.tfm'\n");
2039 		if (req->base.complete != crypto_req_done)
2040 			pr_err("alg: aead: changed 'req->base.complete'\n");
2041 		if (req->base.flags != req_flags)
2042 			pr_err("alg: aead: changed 'req->base.flags'\n");
2043 		if (req->base.data != &wait)
2044 			pr_err("alg: aead: changed 'req->base.data'\n");
2045 		return -EINVAL;
2046 	}
2047 	if (is_test_sglist_corrupted(&tsgls->src)) {
2048 		pr_err("alg: aead: %s %s corrupted src sgl on test vector %s, cfg=\"%s\"\n",
2049 		       driver, op, vec_name, cfg->name);
2050 		return -EINVAL;
2051 	}
2052 	if (tsgls->dst.sgl_ptr != tsgls->src.sgl &&
2053 	    is_test_sglist_corrupted(&tsgls->dst)) {
2054 		pr_err("alg: aead: %s %s corrupted dst sgl on test vector %s, cfg=\"%s\"\n",
2055 		       driver, op, vec_name, cfg->name);
2056 		return -EINVAL;
2057 	}
2058 
2059 	/* Check for unexpected success or failure, or wrong error code */
2060 	if ((err == 0 && vec->novrfy) ||
2061 	    (err != vec->crypt_error && !(err == -EBADMSG && vec->novrfy))) {
2062 		char expected_error[32];
2063 
2064 		if (vec->novrfy &&
2065 		    vec->crypt_error != 0 && vec->crypt_error != -EBADMSG)
2066 			sprintf(expected_error, "-EBADMSG or %d",
2067 				vec->crypt_error);
2068 		else if (vec->novrfy)
2069 			sprintf(expected_error, "-EBADMSG");
2070 		else
2071 			sprintf(expected_error, "%d", vec->crypt_error);
2072 		if (err) {
2073 			pr_err("alg: aead: %s %s failed on test vector %s; expected_error=%s, actual_error=%d, cfg=\"%s\"\n",
2074 			       driver, op, vec_name, expected_error, err,
2075 			       cfg->name);
2076 			return err;
2077 		}
2078 		pr_err("alg: aead: %s %s unexpectedly succeeded on test vector %s; expected_error=%s, cfg=\"%s\"\n",
2079 		       driver, op, vec_name, expected_error, cfg->name);
2080 		return -EINVAL;
2081 	}
2082 	if (err) /* Expectedly failed. */
2083 		return 0;
2084 
2085 	/* Check for the correct output (ciphertext or plaintext) */
2086 	err = verify_correct_output(&tsgls->dst, enc ? vec->ctext : vec->ptext,
2087 				    enc ? vec->clen : vec->plen,
2088 				    vec->alen, enc || !cfg->inplace);
2089 	if (err == -EOVERFLOW) {
2090 		pr_err("alg: aead: %s %s overran dst buffer on test vector %s, cfg=\"%s\"\n",
2091 		       driver, op, vec_name, cfg->name);
2092 		return err;
2093 	}
2094 	if (err) {
2095 		pr_err("alg: aead: %s %s test failed (wrong result) on test vector %s, cfg=\"%s\"\n",
2096 		       driver, op, vec_name, cfg->name);
2097 		return err;
2098 	}
2099 
2100 	return 0;
2101 }
2102 
2103 static int test_aead_vec(int enc, const struct aead_testvec *vec,
2104 			 unsigned int vec_num, struct aead_request *req,
2105 			 struct cipher_test_sglists *tsgls)
2106 {
2107 	char vec_name[16];
2108 	unsigned int i;
2109 	int err;
2110 
2111 	if (enc && vec->novrfy)
2112 		return 0;
2113 
2114 	sprintf(vec_name, "%u", vec_num);
2115 
2116 	for (i = 0; i < ARRAY_SIZE(default_cipher_testvec_configs); i++) {
2117 		err = test_aead_vec_cfg(enc, vec, vec_name,
2118 					&default_cipher_testvec_configs[i],
2119 					req, tsgls);
2120 		if (err)
2121 			return err;
2122 	}
2123 
2124 #ifdef CONFIG_CRYPTO_MANAGER_EXTRA_TESTS
2125 	if (!noextratests) {
2126 		struct testvec_config cfg;
2127 		char cfgname[TESTVEC_CONFIG_NAMELEN];
2128 
2129 		for (i = 0; i < fuzz_iterations; i++) {
2130 			generate_random_testvec_config(&cfg, cfgname,
2131 						       sizeof(cfgname));
2132 			err = test_aead_vec_cfg(enc, vec, vec_name,
2133 						&cfg, req, tsgls);
2134 			if (err)
2135 				return err;
2136 			cond_resched();
2137 		}
2138 	}
2139 #endif
2140 	return 0;
2141 }
2142 
2143 #ifdef CONFIG_CRYPTO_MANAGER_EXTRA_TESTS
2144 
2145 struct aead_extra_tests_ctx {
2146 	struct aead_request *req;
2147 	struct crypto_aead *tfm;
2148 	const struct alg_test_desc *test_desc;
2149 	struct cipher_test_sglists *tsgls;
2150 	unsigned int maxdatasize;
2151 	unsigned int maxkeysize;
2152 
2153 	struct aead_testvec vec;
2154 	char vec_name[64];
2155 	char cfgname[TESTVEC_CONFIG_NAMELEN];
2156 	struct testvec_config cfg;
2157 };
2158 
2159 /*
2160  * Make at least one random change to a (ciphertext, AAD) pair.  "Ciphertext"
2161  * here means the full ciphertext including the authentication tag.  The
2162  * authentication tag (and hence also the ciphertext) is assumed to be nonempty.
2163  */
2164 static void mutate_aead_message(struct aead_testvec *vec, bool aad_iv,
2165 				unsigned int ivsize)
2166 {
2167 	const unsigned int aad_tail_size = aad_iv ? ivsize : 0;
2168 	const unsigned int authsize = vec->clen - vec->plen;
2169 
2170 	if (prandom_u32() % 2 == 0 && vec->alen > aad_tail_size) {
2171 		 /* Mutate the AAD */
2172 		flip_random_bit((u8 *)vec->assoc, vec->alen - aad_tail_size);
2173 		if (prandom_u32() % 2 == 0)
2174 			return;
2175 	}
2176 	if (prandom_u32() % 2 == 0) {
2177 		/* Mutate auth tag (assuming it's at the end of ciphertext) */
2178 		flip_random_bit((u8 *)vec->ctext + vec->plen, authsize);
2179 	} else {
2180 		/* Mutate any part of the ciphertext */
2181 		flip_random_bit((u8 *)vec->ctext, vec->clen);
2182 	}
2183 }
2184 
2185 /*
2186  * Minimum authentication tag size in bytes at which we assume that we can
2187  * reliably generate inauthentic messages, i.e. not generate an authentic
2188  * message by chance.
2189  */
2190 #define MIN_COLLISION_FREE_AUTHSIZE 8
2191 
2192 static void generate_aead_message(struct aead_request *req,
2193 				  const struct aead_test_suite *suite,
2194 				  struct aead_testvec *vec,
2195 				  bool prefer_inauthentic)
2196 {
2197 	struct crypto_aead *tfm = crypto_aead_reqtfm(req);
2198 	const unsigned int ivsize = crypto_aead_ivsize(tfm);
2199 	const unsigned int authsize = vec->clen - vec->plen;
2200 	const bool inauthentic = (authsize >= MIN_COLLISION_FREE_AUTHSIZE) &&
2201 				 (prefer_inauthentic || prandom_u32() % 4 == 0);
2202 
2203 	/* Generate the AAD. */
2204 	generate_random_bytes((u8 *)vec->assoc, vec->alen);
2205 	if (suite->aad_iv && vec->alen >= ivsize)
2206 		/* Avoid implementation-defined behavior. */
2207 		memcpy((u8 *)vec->assoc + vec->alen - ivsize, vec->iv, ivsize);
2208 
2209 	if (inauthentic && prandom_u32() % 2 == 0) {
2210 		/* Generate a random ciphertext. */
2211 		generate_random_bytes((u8 *)vec->ctext, vec->clen);
2212 	} else {
2213 		int i = 0;
2214 		struct scatterlist src[2], dst;
2215 		u8 iv[MAX_IVLEN];
2216 		DECLARE_CRYPTO_WAIT(wait);
2217 
2218 		/* Generate a random plaintext and encrypt it. */
2219 		sg_init_table(src, 2);
2220 		if (vec->alen)
2221 			sg_set_buf(&src[i++], vec->assoc, vec->alen);
2222 		if (vec->plen) {
2223 			generate_random_bytes((u8 *)vec->ptext, vec->plen);
2224 			sg_set_buf(&src[i++], vec->ptext, vec->plen);
2225 		}
2226 		sg_init_one(&dst, vec->ctext, vec->alen + vec->clen);
2227 		memcpy(iv, vec->iv, ivsize);
2228 		aead_request_set_callback(req, 0, crypto_req_done, &wait);
2229 		aead_request_set_crypt(req, src, &dst, vec->plen, iv);
2230 		aead_request_set_ad(req, vec->alen);
2231 		vec->crypt_error = crypto_wait_req(crypto_aead_encrypt(req),
2232 						   &wait);
2233 		/* If encryption failed, we're done. */
2234 		if (vec->crypt_error != 0)
2235 			return;
2236 		memmove((u8 *)vec->ctext, vec->ctext + vec->alen, vec->clen);
2237 		if (!inauthentic)
2238 			return;
2239 		/*
2240 		 * Mutate the authentic (ciphertext, AAD) pair to get an
2241 		 * inauthentic one.
2242 		 */
2243 		mutate_aead_message(vec, suite->aad_iv, ivsize);
2244 	}
2245 	vec->novrfy = 1;
2246 	if (suite->einval_allowed)
2247 		vec->crypt_error = -EINVAL;
2248 }
2249 
2250 /*
2251  * Generate an AEAD test vector 'vec' using the implementation specified by
2252  * 'req'.  The buffers in 'vec' must already be allocated.
2253  *
2254  * If 'prefer_inauthentic' is true, then this function will generate inauthentic
2255  * test vectors (i.e. vectors with 'vec->novrfy=1') more often.
2256  */
2257 static void generate_random_aead_testvec(struct aead_request *req,
2258 					 struct aead_testvec *vec,
2259 					 const struct aead_test_suite *suite,
2260 					 unsigned int maxkeysize,
2261 					 unsigned int maxdatasize,
2262 					 char *name, size_t max_namelen,
2263 					 bool prefer_inauthentic)
2264 {
2265 	struct crypto_aead *tfm = crypto_aead_reqtfm(req);
2266 	const unsigned int ivsize = crypto_aead_ivsize(tfm);
2267 	const unsigned int maxauthsize = crypto_aead_maxauthsize(tfm);
2268 	unsigned int authsize;
2269 	unsigned int total_len;
2270 
2271 	/* Key: length in [0, maxkeysize], but usually choose maxkeysize */
2272 	vec->klen = maxkeysize;
2273 	if (prandom_u32() % 4 == 0)
2274 		vec->klen = prandom_u32() % (maxkeysize + 1);
2275 	generate_random_bytes((u8 *)vec->key, vec->klen);
2276 	vec->setkey_error = crypto_aead_setkey(tfm, vec->key, vec->klen);
2277 
2278 	/* IV */
2279 	generate_random_bytes((u8 *)vec->iv, ivsize);
2280 
2281 	/* Tag length: in [0, maxauthsize], but usually choose maxauthsize */
2282 	authsize = maxauthsize;
2283 	if (prandom_u32() % 4 == 0)
2284 		authsize = prandom_u32() % (maxauthsize + 1);
2285 	if (prefer_inauthentic && authsize < MIN_COLLISION_FREE_AUTHSIZE)
2286 		authsize = MIN_COLLISION_FREE_AUTHSIZE;
2287 	if (WARN_ON(authsize > maxdatasize))
2288 		authsize = maxdatasize;
2289 	maxdatasize -= authsize;
2290 	vec->setauthsize_error = crypto_aead_setauthsize(tfm, authsize);
2291 
2292 	/* AAD, plaintext, and ciphertext lengths */
2293 	total_len = generate_random_length(maxdatasize);
2294 	if (prandom_u32() % 4 == 0)
2295 		vec->alen = 0;
2296 	else
2297 		vec->alen = generate_random_length(total_len);
2298 	vec->plen = total_len - vec->alen;
2299 	vec->clen = vec->plen + authsize;
2300 
2301 	/*
2302 	 * Generate the AAD, plaintext, and ciphertext.  Not applicable if the
2303 	 * key or the authentication tag size couldn't be set.
2304 	 */
2305 	vec->novrfy = 0;
2306 	vec->crypt_error = 0;
2307 	if (vec->setkey_error == 0 && vec->setauthsize_error == 0)
2308 		generate_aead_message(req, suite, vec, prefer_inauthentic);
2309 	snprintf(name, max_namelen,
2310 		 "\"random: alen=%u plen=%u authsize=%u klen=%u novrfy=%d\"",
2311 		 vec->alen, vec->plen, authsize, vec->klen, vec->novrfy);
2312 }
2313 
2314 static void try_to_generate_inauthentic_testvec(
2315 					struct aead_extra_tests_ctx *ctx)
2316 {
2317 	int i;
2318 
2319 	for (i = 0; i < 10; i++) {
2320 		generate_random_aead_testvec(ctx->req, &ctx->vec,
2321 					     &ctx->test_desc->suite.aead,
2322 					     ctx->maxkeysize, ctx->maxdatasize,
2323 					     ctx->vec_name,
2324 					     sizeof(ctx->vec_name), true);
2325 		if (ctx->vec.novrfy)
2326 			return;
2327 	}
2328 }
2329 
2330 /*
2331  * Generate inauthentic test vectors (i.e. ciphertext, AAD pairs that aren't the
2332  * result of an encryption with the key) and verify that decryption fails.
2333  */
2334 static int test_aead_inauthentic_inputs(struct aead_extra_tests_ctx *ctx)
2335 {
2336 	unsigned int i;
2337 	int err;
2338 
2339 	for (i = 0; i < fuzz_iterations * 8; i++) {
2340 		/*
2341 		 * Since this part of the tests isn't comparing the
2342 		 * implementation to another, there's no point in testing any
2343 		 * test vectors other than inauthentic ones (vec.novrfy=1) here.
2344 		 *
2345 		 * If we're having trouble generating such a test vector, e.g.
2346 		 * if the algorithm keeps rejecting the generated keys, don't
2347 		 * retry forever; just continue on.
2348 		 */
2349 		try_to_generate_inauthentic_testvec(ctx);
2350 		if (ctx->vec.novrfy) {
2351 			generate_random_testvec_config(&ctx->cfg, ctx->cfgname,
2352 						       sizeof(ctx->cfgname));
2353 			err = test_aead_vec_cfg(DECRYPT, &ctx->vec,
2354 						ctx->vec_name, &ctx->cfg,
2355 						ctx->req, ctx->tsgls);
2356 			if (err)
2357 				return err;
2358 		}
2359 		cond_resched();
2360 	}
2361 	return 0;
2362 }
2363 
2364 /*
2365  * Test the AEAD algorithm against the corresponding generic implementation, if
2366  * one is available.
2367  */
2368 static int test_aead_vs_generic_impl(struct aead_extra_tests_ctx *ctx)
2369 {
2370 	struct crypto_aead *tfm = ctx->tfm;
2371 	const char *algname = crypto_aead_alg(tfm)->base.cra_name;
2372 	const char *driver = crypto_aead_driver_name(tfm);
2373 	const char *generic_driver = ctx->test_desc->generic_driver;
2374 	char _generic_driver[CRYPTO_MAX_ALG_NAME];
2375 	struct crypto_aead *generic_tfm = NULL;
2376 	struct aead_request *generic_req = NULL;
2377 	unsigned int i;
2378 	int err;
2379 
2380 	if (!generic_driver) { /* Use default naming convention? */
2381 		err = build_generic_driver_name(algname, _generic_driver);
2382 		if (err)
2383 			return err;
2384 		generic_driver = _generic_driver;
2385 	}
2386 
2387 	if (strcmp(generic_driver, driver) == 0) /* Already the generic impl? */
2388 		return 0;
2389 
2390 	generic_tfm = crypto_alloc_aead(generic_driver, 0, 0);
2391 	if (IS_ERR(generic_tfm)) {
2392 		err = PTR_ERR(generic_tfm);
2393 		if (err == -ENOENT) {
2394 			pr_warn("alg: aead: skipping comparison tests for %s because %s is unavailable\n",
2395 				driver, generic_driver);
2396 			return 0;
2397 		}
2398 		pr_err("alg: aead: error allocating %s (generic impl of %s): %d\n",
2399 		       generic_driver, algname, err);
2400 		return err;
2401 	}
2402 
2403 	generic_req = aead_request_alloc(generic_tfm, GFP_KERNEL);
2404 	if (!generic_req) {
2405 		err = -ENOMEM;
2406 		goto out;
2407 	}
2408 
2409 	/* Check the algorithm properties for consistency. */
2410 
2411 	if (crypto_aead_maxauthsize(tfm) !=
2412 	    crypto_aead_maxauthsize(generic_tfm)) {
2413 		pr_err("alg: aead: maxauthsize for %s (%u) doesn't match generic impl (%u)\n",
2414 		       driver, crypto_aead_maxauthsize(tfm),
2415 		       crypto_aead_maxauthsize(generic_tfm));
2416 		err = -EINVAL;
2417 		goto out;
2418 	}
2419 
2420 	if (crypto_aead_ivsize(tfm) != crypto_aead_ivsize(generic_tfm)) {
2421 		pr_err("alg: aead: ivsize for %s (%u) doesn't match generic impl (%u)\n",
2422 		       driver, crypto_aead_ivsize(tfm),
2423 		       crypto_aead_ivsize(generic_tfm));
2424 		err = -EINVAL;
2425 		goto out;
2426 	}
2427 
2428 	if (crypto_aead_blocksize(tfm) != crypto_aead_blocksize(generic_tfm)) {
2429 		pr_err("alg: aead: blocksize for %s (%u) doesn't match generic impl (%u)\n",
2430 		       driver, crypto_aead_blocksize(tfm),
2431 		       crypto_aead_blocksize(generic_tfm));
2432 		err = -EINVAL;
2433 		goto out;
2434 	}
2435 
2436 	/*
2437 	 * Now generate test vectors using the generic implementation, and test
2438 	 * the other implementation against them.
2439 	 */
2440 	for (i = 0; i < fuzz_iterations * 8; i++) {
2441 		generate_random_aead_testvec(generic_req, &ctx->vec,
2442 					     &ctx->test_desc->suite.aead,
2443 					     ctx->maxkeysize, ctx->maxdatasize,
2444 					     ctx->vec_name,
2445 					     sizeof(ctx->vec_name), false);
2446 		generate_random_testvec_config(&ctx->cfg, ctx->cfgname,
2447 					       sizeof(ctx->cfgname));
2448 		if (!ctx->vec.novrfy) {
2449 			err = test_aead_vec_cfg(ENCRYPT, &ctx->vec,
2450 						ctx->vec_name, &ctx->cfg,
2451 						ctx->req, ctx->tsgls);
2452 			if (err)
2453 				goto out;
2454 		}
2455 		if (ctx->vec.crypt_error == 0 || ctx->vec.novrfy) {
2456 			err = test_aead_vec_cfg(DECRYPT, &ctx->vec,
2457 						ctx->vec_name, &ctx->cfg,
2458 						ctx->req, ctx->tsgls);
2459 			if (err)
2460 				goto out;
2461 		}
2462 		cond_resched();
2463 	}
2464 	err = 0;
2465 out:
2466 	crypto_free_aead(generic_tfm);
2467 	aead_request_free(generic_req);
2468 	return err;
2469 }
2470 
2471 static int test_aead_extra(const struct alg_test_desc *test_desc,
2472 			   struct aead_request *req,
2473 			   struct cipher_test_sglists *tsgls)
2474 {
2475 	struct aead_extra_tests_ctx *ctx;
2476 	unsigned int i;
2477 	int err;
2478 
2479 	if (noextratests)
2480 		return 0;
2481 
2482 	ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
2483 	if (!ctx)
2484 		return -ENOMEM;
2485 	ctx->req = req;
2486 	ctx->tfm = crypto_aead_reqtfm(req);
2487 	ctx->test_desc = test_desc;
2488 	ctx->tsgls = tsgls;
2489 	ctx->maxdatasize = (2 * PAGE_SIZE) - TESTMGR_POISON_LEN;
2490 	ctx->maxkeysize = 0;
2491 	for (i = 0; i < test_desc->suite.aead.count; i++)
2492 		ctx->maxkeysize = max_t(unsigned int, ctx->maxkeysize,
2493 					test_desc->suite.aead.vecs[i].klen);
2494 
2495 	ctx->vec.key = kmalloc(ctx->maxkeysize, GFP_KERNEL);
2496 	ctx->vec.iv = kmalloc(crypto_aead_ivsize(ctx->tfm), GFP_KERNEL);
2497 	ctx->vec.assoc = kmalloc(ctx->maxdatasize, GFP_KERNEL);
2498 	ctx->vec.ptext = kmalloc(ctx->maxdatasize, GFP_KERNEL);
2499 	ctx->vec.ctext = kmalloc(ctx->maxdatasize, GFP_KERNEL);
2500 	if (!ctx->vec.key || !ctx->vec.iv || !ctx->vec.assoc ||
2501 	    !ctx->vec.ptext || !ctx->vec.ctext) {
2502 		err = -ENOMEM;
2503 		goto out;
2504 	}
2505 
2506 	err = test_aead_vs_generic_impl(ctx);
2507 	if (err)
2508 		goto out;
2509 
2510 	err = test_aead_inauthentic_inputs(ctx);
2511 out:
2512 	kfree(ctx->vec.key);
2513 	kfree(ctx->vec.iv);
2514 	kfree(ctx->vec.assoc);
2515 	kfree(ctx->vec.ptext);
2516 	kfree(ctx->vec.ctext);
2517 	kfree(ctx);
2518 	return err;
2519 }
2520 #else /* !CONFIG_CRYPTO_MANAGER_EXTRA_TESTS */
2521 static int test_aead_extra(const struct alg_test_desc *test_desc,
2522 			   struct aead_request *req,
2523 			   struct cipher_test_sglists *tsgls)
2524 {
2525 	return 0;
2526 }
2527 #endif /* !CONFIG_CRYPTO_MANAGER_EXTRA_TESTS */
2528 
2529 static int test_aead(int enc, const struct aead_test_suite *suite,
2530 		     struct aead_request *req,
2531 		     struct cipher_test_sglists *tsgls)
2532 {
2533 	unsigned int i;
2534 	int err;
2535 
2536 	for (i = 0; i < suite->count; i++) {
2537 		err = test_aead_vec(enc, &suite->vecs[i], i, req, tsgls);
2538 		if (err)
2539 			return err;
2540 		cond_resched();
2541 	}
2542 	return 0;
2543 }
2544 
2545 static int alg_test_aead(const struct alg_test_desc *desc, const char *driver,
2546 			 u32 type, u32 mask)
2547 {
2548 	const struct aead_test_suite *suite = &desc->suite.aead;
2549 	struct crypto_aead *tfm;
2550 	struct aead_request *req = NULL;
2551 	struct cipher_test_sglists *tsgls = NULL;
2552 	int err;
2553 
2554 	if (suite->count <= 0) {
2555 		pr_err("alg: aead: empty test suite for %s\n", driver);
2556 		return -EINVAL;
2557 	}
2558 
2559 	tfm = crypto_alloc_aead(driver, type, mask);
2560 	if (IS_ERR(tfm)) {
2561 		pr_err("alg: aead: failed to allocate transform for %s: %ld\n",
2562 		       driver, PTR_ERR(tfm));
2563 		return PTR_ERR(tfm);
2564 	}
2565 	driver = crypto_aead_driver_name(tfm);
2566 
2567 	req = aead_request_alloc(tfm, GFP_KERNEL);
2568 	if (!req) {
2569 		pr_err("alg: aead: failed to allocate request for %s\n",
2570 		       driver);
2571 		err = -ENOMEM;
2572 		goto out;
2573 	}
2574 
2575 	tsgls = alloc_cipher_test_sglists();
2576 	if (!tsgls) {
2577 		pr_err("alg: aead: failed to allocate test buffers for %s\n",
2578 		       driver);
2579 		err = -ENOMEM;
2580 		goto out;
2581 	}
2582 
2583 	err = test_aead(ENCRYPT, suite, req, tsgls);
2584 	if (err)
2585 		goto out;
2586 
2587 	err = test_aead(DECRYPT, suite, req, tsgls);
2588 	if (err)
2589 		goto out;
2590 
2591 	err = test_aead_extra(desc, req, tsgls);
2592 out:
2593 	free_cipher_test_sglists(tsgls);
2594 	aead_request_free(req);
2595 	crypto_free_aead(tfm);
2596 	return err;
2597 }
2598 
2599 static int test_cipher(struct crypto_cipher *tfm, int enc,
2600 		       const struct cipher_testvec *template,
2601 		       unsigned int tcount)
2602 {
2603 	const char *algo = crypto_tfm_alg_driver_name(crypto_cipher_tfm(tfm));
2604 	unsigned int i, j, k;
2605 	char *q;
2606 	const char *e;
2607 	const char *input, *result;
2608 	void *data;
2609 	char *xbuf[XBUFSIZE];
2610 	int ret = -ENOMEM;
2611 
2612 	if (testmgr_alloc_buf(xbuf))
2613 		goto out_nobuf;
2614 
2615 	if (enc == ENCRYPT)
2616 	        e = "encryption";
2617 	else
2618 		e = "decryption";
2619 
2620 	j = 0;
2621 	for (i = 0; i < tcount; i++) {
2622 
2623 		if (fips_enabled && template[i].fips_skip)
2624 			continue;
2625 
2626 		input  = enc ? template[i].ptext : template[i].ctext;
2627 		result = enc ? template[i].ctext : template[i].ptext;
2628 		j++;
2629 
2630 		ret = -EINVAL;
2631 		if (WARN_ON(template[i].len > PAGE_SIZE))
2632 			goto out;
2633 
2634 		data = xbuf[0];
2635 		memcpy(data, input, template[i].len);
2636 
2637 		crypto_cipher_clear_flags(tfm, ~0);
2638 		if (template[i].wk)
2639 			crypto_cipher_set_flags(tfm, CRYPTO_TFM_REQ_FORBID_WEAK_KEYS);
2640 
2641 		ret = crypto_cipher_setkey(tfm, template[i].key,
2642 					   template[i].klen);
2643 		if (ret) {
2644 			if (ret == template[i].setkey_error)
2645 				continue;
2646 			pr_err("alg: cipher: %s setkey failed on test vector %u; expected_error=%d, actual_error=%d, flags=%#x\n",
2647 			       algo, j, template[i].setkey_error, ret,
2648 			       crypto_cipher_get_flags(tfm));
2649 			goto out;
2650 		}
2651 		if (template[i].setkey_error) {
2652 			pr_err("alg: cipher: %s setkey unexpectedly succeeded on test vector %u; expected_error=%d\n",
2653 			       algo, j, template[i].setkey_error);
2654 			ret = -EINVAL;
2655 			goto out;
2656 		}
2657 
2658 		for (k = 0; k < template[i].len;
2659 		     k += crypto_cipher_blocksize(tfm)) {
2660 			if (enc)
2661 				crypto_cipher_encrypt_one(tfm, data + k,
2662 							  data + k);
2663 			else
2664 				crypto_cipher_decrypt_one(tfm, data + k,
2665 							  data + k);
2666 		}
2667 
2668 		q = data;
2669 		if (memcmp(q, result, template[i].len)) {
2670 			printk(KERN_ERR "alg: cipher: Test %d failed "
2671 			       "on %s for %s\n", j, e, algo);
2672 			hexdump(q, template[i].len);
2673 			ret = -EINVAL;
2674 			goto out;
2675 		}
2676 	}
2677 
2678 	ret = 0;
2679 
2680 out:
2681 	testmgr_free_buf(xbuf);
2682 out_nobuf:
2683 	return ret;
2684 }
2685 
2686 static int test_skcipher_vec_cfg(int enc, const struct cipher_testvec *vec,
2687 				 const char *vec_name,
2688 				 const struct testvec_config *cfg,
2689 				 struct skcipher_request *req,
2690 				 struct cipher_test_sglists *tsgls)
2691 {
2692 	struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
2693 	const unsigned int alignmask = crypto_skcipher_alignmask(tfm);
2694 	const unsigned int ivsize = crypto_skcipher_ivsize(tfm);
2695 	const char *driver = crypto_skcipher_driver_name(tfm);
2696 	const u32 req_flags = CRYPTO_TFM_REQ_MAY_BACKLOG | cfg->req_flags;
2697 	const char *op = enc ? "encryption" : "decryption";
2698 	DECLARE_CRYPTO_WAIT(wait);
2699 	u8 _iv[3 * (MAX_ALGAPI_ALIGNMASK + 1) + MAX_IVLEN];
2700 	u8 *iv = PTR_ALIGN(&_iv[0], 2 * (MAX_ALGAPI_ALIGNMASK + 1)) +
2701 		 cfg->iv_offset +
2702 		 (cfg->iv_offset_relative_to_alignmask ? alignmask : 0);
2703 	struct kvec input;
2704 	int err;
2705 
2706 	/* Set the key */
2707 	if (vec->wk)
2708 		crypto_skcipher_set_flags(tfm, CRYPTO_TFM_REQ_FORBID_WEAK_KEYS);
2709 	else
2710 		crypto_skcipher_clear_flags(tfm,
2711 					    CRYPTO_TFM_REQ_FORBID_WEAK_KEYS);
2712 	err = do_setkey(crypto_skcipher_setkey, tfm, vec->key, vec->klen,
2713 			cfg, alignmask);
2714 	if (err) {
2715 		if (err == vec->setkey_error)
2716 			return 0;
2717 		pr_err("alg: skcipher: %s setkey failed on test vector %s; expected_error=%d, actual_error=%d, flags=%#x\n",
2718 		       driver, vec_name, vec->setkey_error, err,
2719 		       crypto_skcipher_get_flags(tfm));
2720 		return err;
2721 	}
2722 	if (vec->setkey_error) {
2723 		pr_err("alg: skcipher: %s setkey unexpectedly succeeded on test vector %s; expected_error=%d\n",
2724 		       driver, vec_name, vec->setkey_error);
2725 		return -EINVAL;
2726 	}
2727 
2728 	/* The IV must be copied to a buffer, as the algorithm may modify it */
2729 	if (ivsize) {
2730 		if (WARN_ON(ivsize > MAX_IVLEN))
2731 			return -EINVAL;
2732 		if (vec->generates_iv && !enc)
2733 			memcpy(iv, vec->iv_out, ivsize);
2734 		else if (vec->iv)
2735 			memcpy(iv, vec->iv, ivsize);
2736 		else
2737 			memset(iv, 0, ivsize);
2738 	} else {
2739 		if (vec->generates_iv) {
2740 			pr_err("alg: skcipher: %s has ivsize=0 but test vector %s generates IV!\n",
2741 			       driver, vec_name);
2742 			return -EINVAL;
2743 		}
2744 		iv = NULL;
2745 	}
2746 
2747 	/* Build the src/dst scatterlists */
2748 	input.iov_base = enc ? (void *)vec->ptext : (void *)vec->ctext;
2749 	input.iov_len = vec->len;
2750 	err = build_cipher_test_sglists(tsgls, cfg, alignmask,
2751 					vec->len, vec->len, &input, 1);
2752 	if (err) {
2753 		pr_err("alg: skcipher: %s %s: error preparing scatterlists for test vector %s, cfg=\"%s\"\n",
2754 		       driver, op, vec_name, cfg->name);
2755 		return err;
2756 	}
2757 
2758 	/* Do the actual encryption or decryption */
2759 	testmgr_poison(req->__ctx, crypto_skcipher_reqsize(tfm));
2760 	skcipher_request_set_callback(req, req_flags, crypto_req_done, &wait);
2761 	skcipher_request_set_crypt(req, tsgls->src.sgl_ptr, tsgls->dst.sgl_ptr,
2762 				   vec->len, iv);
2763 	if (cfg->nosimd)
2764 		crypto_disable_simd_for_test();
2765 	err = enc ? crypto_skcipher_encrypt(req) : crypto_skcipher_decrypt(req);
2766 	if (cfg->nosimd)
2767 		crypto_reenable_simd_for_test();
2768 	err = crypto_wait_req(err, &wait);
2769 
2770 	/* Check that the algorithm didn't overwrite things it shouldn't have */
2771 	if (req->cryptlen != vec->len ||
2772 	    req->iv != iv ||
2773 	    req->src != tsgls->src.sgl_ptr ||
2774 	    req->dst != tsgls->dst.sgl_ptr ||
2775 	    crypto_skcipher_reqtfm(req) != tfm ||
2776 	    req->base.complete != crypto_req_done ||
2777 	    req->base.flags != req_flags ||
2778 	    req->base.data != &wait) {
2779 		pr_err("alg: skcipher: %s %s corrupted request struct on test vector %s, cfg=\"%s\"\n",
2780 		       driver, op, vec_name, cfg->name);
2781 		if (req->cryptlen != vec->len)
2782 			pr_err("alg: skcipher: changed 'req->cryptlen'\n");
2783 		if (req->iv != iv)
2784 			pr_err("alg: skcipher: changed 'req->iv'\n");
2785 		if (req->src != tsgls->src.sgl_ptr)
2786 			pr_err("alg: skcipher: changed 'req->src'\n");
2787 		if (req->dst != tsgls->dst.sgl_ptr)
2788 			pr_err("alg: skcipher: changed 'req->dst'\n");
2789 		if (crypto_skcipher_reqtfm(req) != tfm)
2790 			pr_err("alg: skcipher: changed 'req->base.tfm'\n");
2791 		if (req->base.complete != crypto_req_done)
2792 			pr_err("alg: skcipher: changed 'req->base.complete'\n");
2793 		if (req->base.flags != req_flags)
2794 			pr_err("alg: skcipher: changed 'req->base.flags'\n");
2795 		if (req->base.data != &wait)
2796 			pr_err("alg: skcipher: changed 'req->base.data'\n");
2797 		return -EINVAL;
2798 	}
2799 	if (is_test_sglist_corrupted(&tsgls->src)) {
2800 		pr_err("alg: skcipher: %s %s corrupted src sgl on test vector %s, cfg=\"%s\"\n",
2801 		       driver, op, vec_name, cfg->name);
2802 		return -EINVAL;
2803 	}
2804 	if (tsgls->dst.sgl_ptr != tsgls->src.sgl &&
2805 	    is_test_sglist_corrupted(&tsgls->dst)) {
2806 		pr_err("alg: skcipher: %s %s corrupted dst sgl on test vector %s, cfg=\"%s\"\n",
2807 		       driver, op, vec_name, cfg->name);
2808 		return -EINVAL;
2809 	}
2810 
2811 	/* Check for success or failure */
2812 	if (err) {
2813 		if (err == vec->crypt_error)
2814 			return 0;
2815 		pr_err("alg: skcipher: %s %s failed on test vector %s; expected_error=%d, actual_error=%d, cfg=\"%s\"\n",
2816 		       driver, op, vec_name, vec->crypt_error, err, cfg->name);
2817 		return err;
2818 	}
2819 	if (vec->crypt_error) {
2820 		pr_err("alg: skcipher: %s %s unexpectedly succeeded on test vector %s; expected_error=%d, cfg=\"%s\"\n",
2821 		       driver, op, vec_name, vec->crypt_error, cfg->name);
2822 		return -EINVAL;
2823 	}
2824 
2825 	/* Check for the correct output (ciphertext or plaintext) */
2826 	err = verify_correct_output(&tsgls->dst, enc ? vec->ctext : vec->ptext,
2827 				    vec->len, 0, true);
2828 	if (err == -EOVERFLOW) {
2829 		pr_err("alg: skcipher: %s %s overran dst buffer on test vector %s, cfg=\"%s\"\n",
2830 		       driver, op, vec_name, cfg->name);
2831 		return err;
2832 	}
2833 	if (err) {
2834 		pr_err("alg: skcipher: %s %s test failed (wrong result) on test vector %s, cfg=\"%s\"\n",
2835 		       driver, op, vec_name, cfg->name);
2836 		return err;
2837 	}
2838 
2839 	/* If applicable, check that the algorithm generated the correct IV */
2840 	if (vec->iv_out && memcmp(iv, vec->iv_out, ivsize) != 0) {
2841 		pr_err("alg: skcipher: %s %s test failed (wrong output IV) on test vector %s, cfg=\"%s\"\n",
2842 		       driver, op, vec_name, cfg->name);
2843 		hexdump(iv, ivsize);
2844 		return -EINVAL;
2845 	}
2846 
2847 	return 0;
2848 }
2849 
2850 static int test_skcipher_vec(int enc, const struct cipher_testvec *vec,
2851 			     unsigned int vec_num,
2852 			     struct skcipher_request *req,
2853 			     struct cipher_test_sglists *tsgls)
2854 {
2855 	char vec_name[16];
2856 	unsigned int i;
2857 	int err;
2858 
2859 	if (fips_enabled && vec->fips_skip)
2860 		return 0;
2861 
2862 	sprintf(vec_name, "%u", vec_num);
2863 
2864 	for (i = 0; i < ARRAY_SIZE(default_cipher_testvec_configs); i++) {
2865 		err = test_skcipher_vec_cfg(enc, vec, vec_name,
2866 					    &default_cipher_testvec_configs[i],
2867 					    req, tsgls);
2868 		if (err)
2869 			return err;
2870 	}
2871 
2872 #ifdef CONFIG_CRYPTO_MANAGER_EXTRA_TESTS
2873 	if (!noextratests) {
2874 		struct testvec_config cfg;
2875 		char cfgname[TESTVEC_CONFIG_NAMELEN];
2876 
2877 		for (i = 0; i < fuzz_iterations; i++) {
2878 			generate_random_testvec_config(&cfg, cfgname,
2879 						       sizeof(cfgname));
2880 			err = test_skcipher_vec_cfg(enc, vec, vec_name,
2881 						    &cfg, req, tsgls);
2882 			if (err)
2883 				return err;
2884 			cond_resched();
2885 		}
2886 	}
2887 #endif
2888 	return 0;
2889 }
2890 
2891 #ifdef CONFIG_CRYPTO_MANAGER_EXTRA_TESTS
2892 /*
2893  * Generate a symmetric cipher test vector from the given implementation.
2894  * Assumes the buffers in 'vec' were already allocated.
2895  */
2896 static void generate_random_cipher_testvec(struct skcipher_request *req,
2897 					   struct cipher_testvec *vec,
2898 					   unsigned int maxdatasize,
2899 					   char *name, size_t max_namelen)
2900 {
2901 	struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
2902 	const unsigned int maxkeysize = crypto_skcipher_max_keysize(tfm);
2903 	const unsigned int ivsize = crypto_skcipher_ivsize(tfm);
2904 	struct scatterlist src, dst;
2905 	u8 iv[MAX_IVLEN];
2906 	DECLARE_CRYPTO_WAIT(wait);
2907 
2908 	/* Key: length in [0, maxkeysize], but usually choose maxkeysize */
2909 	vec->klen = maxkeysize;
2910 	if (prandom_u32() % 4 == 0)
2911 		vec->klen = prandom_u32() % (maxkeysize + 1);
2912 	generate_random_bytes((u8 *)vec->key, vec->klen);
2913 	vec->setkey_error = crypto_skcipher_setkey(tfm, vec->key, vec->klen);
2914 
2915 	/* IV */
2916 	generate_random_bytes((u8 *)vec->iv, ivsize);
2917 
2918 	/* Plaintext */
2919 	vec->len = generate_random_length(maxdatasize);
2920 	generate_random_bytes((u8 *)vec->ptext, vec->len);
2921 
2922 	/* If the key couldn't be set, no need to continue to encrypt. */
2923 	if (vec->setkey_error)
2924 		goto done;
2925 
2926 	/* Ciphertext */
2927 	sg_init_one(&src, vec->ptext, vec->len);
2928 	sg_init_one(&dst, vec->ctext, vec->len);
2929 	memcpy(iv, vec->iv, ivsize);
2930 	skcipher_request_set_callback(req, 0, crypto_req_done, &wait);
2931 	skcipher_request_set_crypt(req, &src, &dst, vec->len, iv);
2932 	vec->crypt_error = crypto_wait_req(crypto_skcipher_encrypt(req), &wait);
2933 	if (vec->crypt_error != 0) {
2934 		/*
2935 		 * The only acceptable error here is for an invalid length, so
2936 		 * skcipher decryption should fail with the same error too.
2937 		 * We'll test for this.  But to keep the API usage well-defined,
2938 		 * explicitly initialize the ciphertext buffer too.
2939 		 */
2940 		memset((u8 *)vec->ctext, 0, vec->len);
2941 	}
2942 done:
2943 	snprintf(name, max_namelen, "\"random: len=%u klen=%u\"",
2944 		 vec->len, vec->klen);
2945 }
2946 
2947 /*
2948  * Test the skcipher algorithm represented by @req against the corresponding
2949  * generic implementation, if one is available.
2950  */
2951 static int test_skcipher_vs_generic_impl(const char *generic_driver,
2952 					 struct skcipher_request *req,
2953 					 struct cipher_test_sglists *tsgls)
2954 {
2955 	struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
2956 	const unsigned int maxkeysize = crypto_skcipher_max_keysize(tfm);
2957 	const unsigned int ivsize = crypto_skcipher_ivsize(tfm);
2958 	const unsigned int blocksize = crypto_skcipher_blocksize(tfm);
2959 	const unsigned int maxdatasize = (2 * PAGE_SIZE) - TESTMGR_POISON_LEN;
2960 	const char *algname = crypto_skcipher_alg(tfm)->base.cra_name;
2961 	const char *driver = crypto_skcipher_driver_name(tfm);
2962 	char _generic_driver[CRYPTO_MAX_ALG_NAME];
2963 	struct crypto_skcipher *generic_tfm = NULL;
2964 	struct skcipher_request *generic_req = NULL;
2965 	unsigned int i;
2966 	struct cipher_testvec vec = { 0 };
2967 	char vec_name[64];
2968 	struct testvec_config *cfg;
2969 	char cfgname[TESTVEC_CONFIG_NAMELEN];
2970 	int err;
2971 
2972 	if (noextratests)
2973 		return 0;
2974 
2975 	/* Keywrap isn't supported here yet as it handles its IV differently. */
2976 	if (strncmp(algname, "kw(", 3) == 0)
2977 		return 0;
2978 
2979 	if (!generic_driver) { /* Use default naming convention? */
2980 		err = build_generic_driver_name(algname, _generic_driver);
2981 		if (err)
2982 			return err;
2983 		generic_driver = _generic_driver;
2984 	}
2985 
2986 	if (strcmp(generic_driver, driver) == 0) /* Already the generic impl? */
2987 		return 0;
2988 
2989 	generic_tfm = crypto_alloc_skcipher(generic_driver, 0, 0);
2990 	if (IS_ERR(generic_tfm)) {
2991 		err = PTR_ERR(generic_tfm);
2992 		if (err == -ENOENT) {
2993 			pr_warn("alg: skcipher: skipping comparison tests for %s because %s is unavailable\n",
2994 				driver, generic_driver);
2995 			return 0;
2996 		}
2997 		pr_err("alg: skcipher: error allocating %s (generic impl of %s): %d\n",
2998 		       generic_driver, algname, err);
2999 		return err;
3000 	}
3001 
3002 	cfg = kzalloc(sizeof(*cfg), GFP_KERNEL);
3003 	if (!cfg) {
3004 		err = -ENOMEM;
3005 		goto out;
3006 	}
3007 
3008 	generic_req = skcipher_request_alloc(generic_tfm, GFP_KERNEL);
3009 	if (!generic_req) {
3010 		err = -ENOMEM;
3011 		goto out;
3012 	}
3013 
3014 	/* Check the algorithm properties for consistency. */
3015 
3016 	if (crypto_skcipher_min_keysize(tfm) !=
3017 	    crypto_skcipher_min_keysize(generic_tfm)) {
3018 		pr_err("alg: skcipher: min keysize for %s (%u) doesn't match generic impl (%u)\n",
3019 		       driver, crypto_skcipher_min_keysize(tfm),
3020 		       crypto_skcipher_min_keysize(generic_tfm));
3021 		err = -EINVAL;
3022 		goto out;
3023 	}
3024 
3025 	if (maxkeysize != crypto_skcipher_max_keysize(generic_tfm)) {
3026 		pr_err("alg: skcipher: max keysize for %s (%u) doesn't match generic impl (%u)\n",
3027 		       driver, maxkeysize,
3028 		       crypto_skcipher_max_keysize(generic_tfm));
3029 		err = -EINVAL;
3030 		goto out;
3031 	}
3032 
3033 	if (ivsize != crypto_skcipher_ivsize(generic_tfm)) {
3034 		pr_err("alg: skcipher: ivsize for %s (%u) doesn't match generic impl (%u)\n",
3035 		       driver, ivsize, crypto_skcipher_ivsize(generic_tfm));
3036 		err = -EINVAL;
3037 		goto out;
3038 	}
3039 
3040 	if (blocksize != crypto_skcipher_blocksize(generic_tfm)) {
3041 		pr_err("alg: skcipher: blocksize for %s (%u) doesn't match generic impl (%u)\n",
3042 		       driver, blocksize,
3043 		       crypto_skcipher_blocksize(generic_tfm));
3044 		err = -EINVAL;
3045 		goto out;
3046 	}
3047 
3048 	/*
3049 	 * Now generate test vectors using the generic implementation, and test
3050 	 * the other implementation against them.
3051 	 */
3052 
3053 	vec.key = kmalloc(maxkeysize, GFP_KERNEL);
3054 	vec.iv = kmalloc(ivsize, GFP_KERNEL);
3055 	vec.ptext = kmalloc(maxdatasize, GFP_KERNEL);
3056 	vec.ctext = kmalloc(maxdatasize, GFP_KERNEL);
3057 	if (!vec.key || !vec.iv || !vec.ptext || !vec.ctext) {
3058 		err = -ENOMEM;
3059 		goto out;
3060 	}
3061 
3062 	for (i = 0; i < fuzz_iterations * 8; i++) {
3063 		generate_random_cipher_testvec(generic_req, &vec, maxdatasize,
3064 					       vec_name, sizeof(vec_name));
3065 		generate_random_testvec_config(cfg, cfgname, sizeof(cfgname));
3066 
3067 		err = test_skcipher_vec_cfg(ENCRYPT, &vec, vec_name,
3068 					    cfg, req, tsgls);
3069 		if (err)
3070 			goto out;
3071 		err = test_skcipher_vec_cfg(DECRYPT, &vec, vec_name,
3072 					    cfg, req, tsgls);
3073 		if (err)
3074 			goto out;
3075 		cond_resched();
3076 	}
3077 	err = 0;
3078 out:
3079 	kfree(cfg);
3080 	kfree(vec.key);
3081 	kfree(vec.iv);
3082 	kfree(vec.ptext);
3083 	kfree(vec.ctext);
3084 	crypto_free_skcipher(generic_tfm);
3085 	skcipher_request_free(generic_req);
3086 	return err;
3087 }
3088 #else /* !CONFIG_CRYPTO_MANAGER_EXTRA_TESTS */
3089 static int test_skcipher_vs_generic_impl(const char *generic_driver,
3090 					 struct skcipher_request *req,
3091 					 struct cipher_test_sglists *tsgls)
3092 {
3093 	return 0;
3094 }
3095 #endif /* !CONFIG_CRYPTO_MANAGER_EXTRA_TESTS */
3096 
3097 static int test_skcipher(int enc, const struct cipher_test_suite *suite,
3098 			 struct skcipher_request *req,
3099 			 struct cipher_test_sglists *tsgls)
3100 {
3101 	unsigned int i;
3102 	int err;
3103 
3104 	for (i = 0; i < suite->count; i++) {
3105 		err = test_skcipher_vec(enc, &suite->vecs[i], i, req, tsgls);
3106 		if (err)
3107 			return err;
3108 		cond_resched();
3109 	}
3110 	return 0;
3111 }
3112 
3113 static int alg_test_skcipher(const struct alg_test_desc *desc,
3114 			     const char *driver, u32 type, u32 mask)
3115 {
3116 	const struct cipher_test_suite *suite = &desc->suite.cipher;
3117 	struct crypto_skcipher *tfm;
3118 	struct skcipher_request *req = NULL;
3119 	struct cipher_test_sglists *tsgls = NULL;
3120 	int err;
3121 
3122 	if (suite->count <= 0) {
3123 		pr_err("alg: skcipher: empty test suite for %s\n", driver);
3124 		return -EINVAL;
3125 	}
3126 
3127 	tfm = crypto_alloc_skcipher(driver, type, mask);
3128 	if (IS_ERR(tfm)) {
3129 		pr_err("alg: skcipher: failed to allocate transform for %s: %ld\n",
3130 		       driver, PTR_ERR(tfm));
3131 		return PTR_ERR(tfm);
3132 	}
3133 	driver = crypto_skcipher_driver_name(tfm);
3134 
3135 	req = skcipher_request_alloc(tfm, GFP_KERNEL);
3136 	if (!req) {
3137 		pr_err("alg: skcipher: failed to allocate request for %s\n",
3138 		       driver);
3139 		err = -ENOMEM;
3140 		goto out;
3141 	}
3142 
3143 	tsgls = alloc_cipher_test_sglists();
3144 	if (!tsgls) {
3145 		pr_err("alg: skcipher: failed to allocate test buffers for %s\n",
3146 		       driver);
3147 		err = -ENOMEM;
3148 		goto out;
3149 	}
3150 
3151 	err = test_skcipher(ENCRYPT, suite, req, tsgls);
3152 	if (err)
3153 		goto out;
3154 
3155 	err = test_skcipher(DECRYPT, suite, req, tsgls);
3156 	if (err)
3157 		goto out;
3158 
3159 	err = test_skcipher_vs_generic_impl(desc->generic_driver, req, tsgls);
3160 out:
3161 	free_cipher_test_sglists(tsgls);
3162 	skcipher_request_free(req);
3163 	crypto_free_skcipher(tfm);
3164 	return err;
3165 }
3166 
3167 static int test_comp(struct crypto_comp *tfm,
3168 		     const struct comp_testvec *ctemplate,
3169 		     const struct comp_testvec *dtemplate,
3170 		     int ctcount, int dtcount)
3171 {
3172 	const char *algo = crypto_tfm_alg_driver_name(crypto_comp_tfm(tfm));
3173 	char *output, *decomp_output;
3174 	unsigned int i;
3175 	int ret;
3176 
3177 	output = kmalloc(COMP_BUF_SIZE, GFP_KERNEL);
3178 	if (!output)
3179 		return -ENOMEM;
3180 
3181 	decomp_output = kmalloc(COMP_BUF_SIZE, GFP_KERNEL);
3182 	if (!decomp_output) {
3183 		kfree(output);
3184 		return -ENOMEM;
3185 	}
3186 
3187 	for (i = 0; i < ctcount; i++) {
3188 		int ilen;
3189 		unsigned int dlen = COMP_BUF_SIZE;
3190 
3191 		memset(output, 0, COMP_BUF_SIZE);
3192 		memset(decomp_output, 0, COMP_BUF_SIZE);
3193 
3194 		ilen = ctemplate[i].inlen;
3195 		ret = crypto_comp_compress(tfm, ctemplate[i].input,
3196 					   ilen, output, &dlen);
3197 		if (ret) {
3198 			printk(KERN_ERR "alg: comp: compression failed "
3199 			       "on test %d for %s: ret=%d\n", i + 1, algo,
3200 			       -ret);
3201 			goto out;
3202 		}
3203 
3204 		ilen = dlen;
3205 		dlen = COMP_BUF_SIZE;
3206 		ret = crypto_comp_decompress(tfm, output,
3207 					     ilen, decomp_output, &dlen);
3208 		if (ret) {
3209 			pr_err("alg: comp: compression failed: decompress: on test %d for %s failed: ret=%d\n",
3210 			       i + 1, algo, -ret);
3211 			goto out;
3212 		}
3213 
3214 		if (dlen != ctemplate[i].inlen) {
3215 			printk(KERN_ERR "alg: comp: Compression test %d "
3216 			       "failed for %s: output len = %d\n", i + 1, algo,
3217 			       dlen);
3218 			ret = -EINVAL;
3219 			goto out;
3220 		}
3221 
3222 		if (memcmp(decomp_output, ctemplate[i].input,
3223 			   ctemplate[i].inlen)) {
3224 			pr_err("alg: comp: compression failed: output differs: on test %d for %s\n",
3225 			       i + 1, algo);
3226 			hexdump(decomp_output, dlen);
3227 			ret = -EINVAL;
3228 			goto out;
3229 		}
3230 	}
3231 
3232 	for (i = 0; i < dtcount; i++) {
3233 		int ilen;
3234 		unsigned int dlen = COMP_BUF_SIZE;
3235 
3236 		memset(decomp_output, 0, COMP_BUF_SIZE);
3237 
3238 		ilen = dtemplate[i].inlen;
3239 		ret = crypto_comp_decompress(tfm, dtemplate[i].input,
3240 					     ilen, decomp_output, &dlen);
3241 		if (ret) {
3242 			printk(KERN_ERR "alg: comp: decompression failed "
3243 			       "on test %d for %s: ret=%d\n", i + 1, algo,
3244 			       -ret);
3245 			goto out;
3246 		}
3247 
3248 		if (dlen != dtemplate[i].outlen) {
3249 			printk(KERN_ERR "alg: comp: Decompression test %d "
3250 			       "failed for %s: output len = %d\n", i + 1, algo,
3251 			       dlen);
3252 			ret = -EINVAL;
3253 			goto out;
3254 		}
3255 
3256 		if (memcmp(decomp_output, dtemplate[i].output, dlen)) {
3257 			printk(KERN_ERR "alg: comp: Decompression test %d "
3258 			       "failed for %s\n", i + 1, algo);
3259 			hexdump(decomp_output, dlen);
3260 			ret = -EINVAL;
3261 			goto out;
3262 		}
3263 	}
3264 
3265 	ret = 0;
3266 
3267 out:
3268 	kfree(decomp_output);
3269 	kfree(output);
3270 	return ret;
3271 }
3272 
3273 static int test_acomp(struct crypto_acomp *tfm,
3274 			      const struct comp_testvec *ctemplate,
3275 		      const struct comp_testvec *dtemplate,
3276 		      int ctcount, int dtcount)
3277 {
3278 	const char *algo = crypto_tfm_alg_driver_name(crypto_acomp_tfm(tfm));
3279 	unsigned int i;
3280 	char *output, *decomp_out;
3281 	int ret;
3282 	struct scatterlist src, dst;
3283 	struct acomp_req *req;
3284 	struct crypto_wait wait;
3285 
3286 	output = kmalloc(COMP_BUF_SIZE, GFP_KERNEL);
3287 	if (!output)
3288 		return -ENOMEM;
3289 
3290 	decomp_out = kmalloc(COMP_BUF_SIZE, GFP_KERNEL);
3291 	if (!decomp_out) {
3292 		kfree(output);
3293 		return -ENOMEM;
3294 	}
3295 
3296 	for (i = 0; i < ctcount; i++) {
3297 		unsigned int dlen = COMP_BUF_SIZE;
3298 		int ilen = ctemplate[i].inlen;
3299 		void *input_vec;
3300 
3301 		input_vec = kmemdup(ctemplate[i].input, ilen, GFP_KERNEL);
3302 		if (!input_vec) {
3303 			ret = -ENOMEM;
3304 			goto out;
3305 		}
3306 
3307 		memset(output, 0, dlen);
3308 		crypto_init_wait(&wait);
3309 		sg_init_one(&src, input_vec, ilen);
3310 		sg_init_one(&dst, output, dlen);
3311 
3312 		req = acomp_request_alloc(tfm);
3313 		if (!req) {
3314 			pr_err("alg: acomp: request alloc failed for %s\n",
3315 			       algo);
3316 			kfree(input_vec);
3317 			ret = -ENOMEM;
3318 			goto out;
3319 		}
3320 
3321 		acomp_request_set_params(req, &src, &dst, ilen, dlen);
3322 		acomp_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG,
3323 					   crypto_req_done, &wait);
3324 
3325 		ret = crypto_wait_req(crypto_acomp_compress(req), &wait);
3326 		if (ret) {
3327 			pr_err("alg: acomp: compression failed on test %d for %s: ret=%d\n",
3328 			       i + 1, algo, -ret);
3329 			kfree(input_vec);
3330 			acomp_request_free(req);
3331 			goto out;
3332 		}
3333 
3334 		ilen = req->dlen;
3335 		dlen = COMP_BUF_SIZE;
3336 		sg_init_one(&src, output, ilen);
3337 		sg_init_one(&dst, decomp_out, dlen);
3338 		crypto_init_wait(&wait);
3339 		acomp_request_set_params(req, &src, &dst, ilen, dlen);
3340 
3341 		ret = crypto_wait_req(crypto_acomp_decompress(req), &wait);
3342 		if (ret) {
3343 			pr_err("alg: acomp: compression failed on test %d for %s: ret=%d\n",
3344 			       i + 1, algo, -ret);
3345 			kfree(input_vec);
3346 			acomp_request_free(req);
3347 			goto out;
3348 		}
3349 
3350 		if (req->dlen != ctemplate[i].inlen) {
3351 			pr_err("alg: acomp: Compression test %d failed for %s: output len = %d\n",
3352 			       i + 1, algo, req->dlen);
3353 			ret = -EINVAL;
3354 			kfree(input_vec);
3355 			acomp_request_free(req);
3356 			goto out;
3357 		}
3358 
3359 		if (memcmp(input_vec, decomp_out, req->dlen)) {
3360 			pr_err("alg: acomp: Compression test %d failed for %s\n",
3361 			       i + 1, algo);
3362 			hexdump(output, req->dlen);
3363 			ret = -EINVAL;
3364 			kfree(input_vec);
3365 			acomp_request_free(req);
3366 			goto out;
3367 		}
3368 
3369 		kfree(input_vec);
3370 		acomp_request_free(req);
3371 	}
3372 
3373 	for (i = 0; i < dtcount; i++) {
3374 		unsigned int dlen = COMP_BUF_SIZE;
3375 		int ilen = dtemplate[i].inlen;
3376 		void *input_vec;
3377 
3378 		input_vec = kmemdup(dtemplate[i].input, ilen, GFP_KERNEL);
3379 		if (!input_vec) {
3380 			ret = -ENOMEM;
3381 			goto out;
3382 		}
3383 
3384 		memset(output, 0, dlen);
3385 		crypto_init_wait(&wait);
3386 		sg_init_one(&src, input_vec, ilen);
3387 		sg_init_one(&dst, output, dlen);
3388 
3389 		req = acomp_request_alloc(tfm);
3390 		if (!req) {
3391 			pr_err("alg: acomp: request alloc failed for %s\n",
3392 			       algo);
3393 			kfree(input_vec);
3394 			ret = -ENOMEM;
3395 			goto out;
3396 		}
3397 
3398 		acomp_request_set_params(req, &src, &dst, ilen, dlen);
3399 		acomp_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG,
3400 					   crypto_req_done, &wait);
3401 
3402 		ret = crypto_wait_req(crypto_acomp_decompress(req), &wait);
3403 		if (ret) {
3404 			pr_err("alg: acomp: decompression failed on test %d for %s: ret=%d\n",
3405 			       i + 1, algo, -ret);
3406 			kfree(input_vec);
3407 			acomp_request_free(req);
3408 			goto out;
3409 		}
3410 
3411 		if (req->dlen != dtemplate[i].outlen) {
3412 			pr_err("alg: acomp: Decompression test %d failed for %s: output len = %d\n",
3413 			       i + 1, algo, req->dlen);
3414 			ret = -EINVAL;
3415 			kfree(input_vec);
3416 			acomp_request_free(req);
3417 			goto out;
3418 		}
3419 
3420 		if (memcmp(output, dtemplate[i].output, req->dlen)) {
3421 			pr_err("alg: acomp: Decompression test %d failed for %s\n",
3422 			       i + 1, algo);
3423 			hexdump(output, req->dlen);
3424 			ret = -EINVAL;
3425 			kfree(input_vec);
3426 			acomp_request_free(req);
3427 			goto out;
3428 		}
3429 
3430 		kfree(input_vec);
3431 		acomp_request_free(req);
3432 	}
3433 
3434 	ret = 0;
3435 
3436 out:
3437 	kfree(decomp_out);
3438 	kfree(output);
3439 	return ret;
3440 }
3441 
3442 static int test_cprng(struct crypto_rng *tfm,
3443 		      const struct cprng_testvec *template,
3444 		      unsigned int tcount)
3445 {
3446 	const char *algo = crypto_tfm_alg_driver_name(crypto_rng_tfm(tfm));
3447 	int err = 0, i, j, seedsize;
3448 	u8 *seed;
3449 	char result[32];
3450 
3451 	seedsize = crypto_rng_seedsize(tfm);
3452 
3453 	seed = kmalloc(seedsize, GFP_KERNEL);
3454 	if (!seed) {
3455 		printk(KERN_ERR "alg: cprng: Failed to allocate seed space "
3456 		       "for %s\n", algo);
3457 		return -ENOMEM;
3458 	}
3459 
3460 	for (i = 0; i < tcount; i++) {
3461 		memset(result, 0, 32);
3462 
3463 		memcpy(seed, template[i].v, template[i].vlen);
3464 		memcpy(seed + template[i].vlen, template[i].key,
3465 		       template[i].klen);
3466 		memcpy(seed + template[i].vlen + template[i].klen,
3467 		       template[i].dt, template[i].dtlen);
3468 
3469 		err = crypto_rng_reset(tfm, seed, seedsize);
3470 		if (err) {
3471 			printk(KERN_ERR "alg: cprng: Failed to reset rng "
3472 			       "for %s\n", algo);
3473 			goto out;
3474 		}
3475 
3476 		for (j = 0; j < template[i].loops; j++) {
3477 			err = crypto_rng_get_bytes(tfm, result,
3478 						   template[i].rlen);
3479 			if (err < 0) {
3480 				printk(KERN_ERR "alg: cprng: Failed to obtain "
3481 				       "the correct amount of random data for "
3482 				       "%s (requested %d)\n", algo,
3483 				       template[i].rlen);
3484 				goto out;
3485 			}
3486 		}
3487 
3488 		err = memcmp(result, template[i].result,
3489 			     template[i].rlen);
3490 		if (err) {
3491 			printk(KERN_ERR "alg: cprng: Test %d failed for %s\n",
3492 			       i, algo);
3493 			hexdump(result, template[i].rlen);
3494 			err = -EINVAL;
3495 			goto out;
3496 		}
3497 	}
3498 
3499 out:
3500 	kfree(seed);
3501 	return err;
3502 }
3503 
3504 static int alg_test_cipher(const struct alg_test_desc *desc,
3505 			   const char *driver, u32 type, u32 mask)
3506 {
3507 	const struct cipher_test_suite *suite = &desc->suite.cipher;
3508 	struct crypto_cipher *tfm;
3509 	int err;
3510 
3511 	tfm = crypto_alloc_cipher(driver, type, mask);
3512 	if (IS_ERR(tfm)) {
3513 		printk(KERN_ERR "alg: cipher: Failed to load transform for "
3514 		       "%s: %ld\n", driver, PTR_ERR(tfm));
3515 		return PTR_ERR(tfm);
3516 	}
3517 
3518 	err = test_cipher(tfm, ENCRYPT, suite->vecs, suite->count);
3519 	if (!err)
3520 		err = test_cipher(tfm, DECRYPT, suite->vecs, suite->count);
3521 
3522 	crypto_free_cipher(tfm);
3523 	return err;
3524 }
3525 
3526 static int alg_test_comp(const struct alg_test_desc *desc, const char *driver,
3527 			 u32 type, u32 mask)
3528 {
3529 	struct crypto_comp *comp;
3530 	struct crypto_acomp *acomp;
3531 	int err;
3532 	u32 algo_type = type & CRYPTO_ALG_TYPE_ACOMPRESS_MASK;
3533 
3534 	if (algo_type == CRYPTO_ALG_TYPE_ACOMPRESS) {
3535 		acomp = crypto_alloc_acomp(driver, type, mask);
3536 		if (IS_ERR(acomp)) {
3537 			pr_err("alg: acomp: Failed to load transform for %s: %ld\n",
3538 			       driver, PTR_ERR(acomp));
3539 			return PTR_ERR(acomp);
3540 		}
3541 		err = test_acomp(acomp, desc->suite.comp.comp.vecs,
3542 				 desc->suite.comp.decomp.vecs,
3543 				 desc->suite.comp.comp.count,
3544 				 desc->suite.comp.decomp.count);
3545 		crypto_free_acomp(acomp);
3546 	} else {
3547 		comp = crypto_alloc_comp(driver, type, mask);
3548 		if (IS_ERR(comp)) {
3549 			pr_err("alg: comp: Failed to load transform for %s: %ld\n",
3550 			       driver, PTR_ERR(comp));
3551 			return PTR_ERR(comp);
3552 		}
3553 
3554 		err = test_comp(comp, desc->suite.comp.comp.vecs,
3555 				desc->suite.comp.decomp.vecs,
3556 				desc->suite.comp.comp.count,
3557 				desc->suite.comp.decomp.count);
3558 
3559 		crypto_free_comp(comp);
3560 	}
3561 	return err;
3562 }
3563 
3564 static int alg_test_crc32c(const struct alg_test_desc *desc,
3565 			   const char *driver, u32 type, u32 mask)
3566 {
3567 	struct crypto_shash *tfm;
3568 	__le32 val;
3569 	int err;
3570 
3571 	err = alg_test_hash(desc, driver, type, mask);
3572 	if (err)
3573 		return err;
3574 
3575 	tfm = crypto_alloc_shash(driver, type, mask);
3576 	if (IS_ERR(tfm)) {
3577 		if (PTR_ERR(tfm) == -ENOENT) {
3578 			/*
3579 			 * This crc32c implementation is only available through
3580 			 * ahash API, not the shash API, so the remaining part
3581 			 * of the test is not applicable to it.
3582 			 */
3583 			return 0;
3584 		}
3585 		printk(KERN_ERR "alg: crc32c: Failed to load transform for %s: "
3586 		       "%ld\n", driver, PTR_ERR(tfm));
3587 		return PTR_ERR(tfm);
3588 	}
3589 	driver = crypto_shash_driver_name(tfm);
3590 
3591 	do {
3592 		SHASH_DESC_ON_STACK(shash, tfm);
3593 		u32 *ctx = (u32 *)shash_desc_ctx(shash);
3594 
3595 		shash->tfm = tfm;
3596 
3597 		*ctx = 420553207;
3598 		err = crypto_shash_final(shash, (u8 *)&val);
3599 		if (err) {
3600 			printk(KERN_ERR "alg: crc32c: Operation failed for "
3601 			       "%s: %d\n", driver, err);
3602 			break;
3603 		}
3604 
3605 		if (val != cpu_to_le32(~420553207)) {
3606 			pr_err("alg: crc32c: Test failed for %s: %u\n",
3607 			       driver, le32_to_cpu(val));
3608 			err = -EINVAL;
3609 		}
3610 	} while (0);
3611 
3612 	crypto_free_shash(tfm);
3613 
3614 	return err;
3615 }
3616 
3617 static int alg_test_cprng(const struct alg_test_desc *desc, const char *driver,
3618 			  u32 type, u32 mask)
3619 {
3620 	struct crypto_rng *rng;
3621 	int err;
3622 
3623 	rng = crypto_alloc_rng(driver, type, mask);
3624 	if (IS_ERR(rng)) {
3625 		printk(KERN_ERR "alg: cprng: Failed to load transform for %s: "
3626 		       "%ld\n", driver, PTR_ERR(rng));
3627 		return PTR_ERR(rng);
3628 	}
3629 
3630 	err = test_cprng(rng, desc->suite.cprng.vecs, desc->suite.cprng.count);
3631 
3632 	crypto_free_rng(rng);
3633 
3634 	return err;
3635 }
3636 
3637 
3638 static int drbg_cavs_test(const struct drbg_testvec *test, int pr,
3639 			  const char *driver, u32 type, u32 mask)
3640 {
3641 	int ret = -EAGAIN;
3642 	struct crypto_rng *drng;
3643 	struct drbg_test_data test_data;
3644 	struct drbg_string addtl, pers, testentropy;
3645 	unsigned char *buf = kzalloc(test->expectedlen, GFP_KERNEL);
3646 
3647 	if (!buf)
3648 		return -ENOMEM;
3649 
3650 	drng = crypto_alloc_rng(driver, type, mask);
3651 	if (IS_ERR(drng)) {
3652 		printk(KERN_ERR "alg: drbg: could not allocate DRNG handle for "
3653 		       "%s\n", driver);
3654 		kfree_sensitive(buf);
3655 		return -ENOMEM;
3656 	}
3657 
3658 	test_data.testentropy = &testentropy;
3659 	drbg_string_fill(&testentropy, test->entropy, test->entropylen);
3660 	drbg_string_fill(&pers, test->pers, test->perslen);
3661 	ret = crypto_drbg_reset_test(drng, &pers, &test_data);
3662 	if (ret) {
3663 		printk(KERN_ERR "alg: drbg: Failed to reset rng\n");
3664 		goto outbuf;
3665 	}
3666 
3667 	drbg_string_fill(&addtl, test->addtla, test->addtllen);
3668 	if (pr) {
3669 		drbg_string_fill(&testentropy, test->entpra, test->entprlen);
3670 		ret = crypto_drbg_get_bytes_addtl_test(drng,
3671 			buf, test->expectedlen, &addtl,	&test_data);
3672 	} else {
3673 		ret = crypto_drbg_get_bytes_addtl(drng,
3674 			buf, test->expectedlen, &addtl);
3675 	}
3676 	if (ret < 0) {
3677 		printk(KERN_ERR "alg: drbg: could not obtain random data for "
3678 		       "driver %s\n", driver);
3679 		goto outbuf;
3680 	}
3681 
3682 	drbg_string_fill(&addtl, test->addtlb, test->addtllen);
3683 	if (pr) {
3684 		drbg_string_fill(&testentropy, test->entprb, test->entprlen);
3685 		ret = crypto_drbg_get_bytes_addtl_test(drng,
3686 			buf, test->expectedlen, &addtl, &test_data);
3687 	} else {
3688 		ret = crypto_drbg_get_bytes_addtl(drng,
3689 			buf, test->expectedlen, &addtl);
3690 	}
3691 	if (ret < 0) {
3692 		printk(KERN_ERR "alg: drbg: could not obtain random data for "
3693 		       "driver %s\n", driver);
3694 		goto outbuf;
3695 	}
3696 
3697 	ret = memcmp(test->expected, buf, test->expectedlen);
3698 
3699 outbuf:
3700 	crypto_free_rng(drng);
3701 	kfree_sensitive(buf);
3702 	return ret;
3703 }
3704 
3705 
3706 static int alg_test_drbg(const struct alg_test_desc *desc, const char *driver,
3707 			 u32 type, u32 mask)
3708 {
3709 	int err = 0;
3710 	int pr = 0;
3711 	int i = 0;
3712 	const struct drbg_testvec *template = desc->suite.drbg.vecs;
3713 	unsigned int tcount = desc->suite.drbg.count;
3714 
3715 	if (0 == memcmp(driver, "drbg_pr_", 8))
3716 		pr = 1;
3717 
3718 	for (i = 0; i < tcount; i++) {
3719 		err = drbg_cavs_test(&template[i], pr, driver, type, mask);
3720 		if (err) {
3721 			printk(KERN_ERR "alg: drbg: Test %d failed for %s\n",
3722 			       i, driver);
3723 			err = -EINVAL;
3724 			break;
3725 		}
3726 	}
3727 	return err;
3728 
3729 }
3730 
3731 static int do_test_kpp(struct crypto_kpp *tfm, const struct kpp_testvec *vec,
3732 		       const char *alg)
3733 {
3734 	struct kpp_request *req;
3735 	void *input_buf = NULL;
3736 	void *output_buf = NULL;
3737 	void *a_public = NULL;
3738 	void *a_ss = NULL;
3739 	void *shared_secret = NULL;
3740 	struct crypto_wait wait;
3741 	unsigned int out_len_max;
3742 	int err = -ENOMEM;
3743 	struct scatterlist src, dst;
3744 
3745 	req = kpp_request_alloc(tfm, GFP_KERNEL);
3746 	if (!req)
3747 		return err;
3748 
3749 	crypto_init_wait(&wait);
3750 
3751 	err = crypto_kpp_set_secret(tfm, vec->secret, vec->secret_size);
3752 	if (err < 0)
3753 		goto free_req;
3754 
3755 	out_len_max = crypto_kpp_maxsize(tfm);
3756 	output_buf = kzalloc(out_len_max, GFP_KERNEL);
3757 	if (!output_buf) {
3758 		err = -ENOMEM;
3759 		goto free_req;
3760 	}
3761 
3762 	/* Use appropriate parameter as base */
3763 	kpp_request_set_input(req, NULL, 0);
3764 	sg_init_one(&dst, output_buf, out_len_max);
3765 	kpp_request_set_output(req, &dst, out_len_max);
3766 	kpp_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG,
3767 				 crypto_req_done, &wait);
3768 
3769 	/* Compute party A's public key */
3770 	err = crypto_wait_req(crypto_kpp_generate_public_key(req), &wait);
3771 	if (err) {
3772 		pr_err("alg: %s: Party A: generate public key test failed. err %d\n",
3773 		       alg, err);
3774 		goto free_output;
3775 	}
3776 
3777 	if (vec->genkey) {
3778 		/* Save party A's public key */
3779 		a_public = kmemdup(sg_virt(req->dst), out_len_max, GFP_KERNEL);
3780 		if (!a_public) {
3781 			err = -ENOMEM;
3782 			goto free_output;
3783 		}
3784 	} else {
3785 		/* Verify calculated public key */
3786 		if (memcmp(vec->expected_a_public, sg_virt(req->dst),
3787 			   vec->expected_a_public_size)) {
3788 			pr_err("alg: %s: Party A: generate public key test failed. Invalid output\n",
3789 			       alg);
3790 			err = -EINVAL;
3791 			goto free_output;
3792 		}
3793 	}
3794 
3795 	/* Calculate shared secret key by using counter part (b) public key. */
3796 	input_buf = kmemdup(vec->b_public, vec->b_public_size, GFP_KERNEL);
3797 	if (!input_buf) {
3798 		err = -ENOMEM;
3799 		goto free_output;
3800 	}
3801 
3802 	sg_init_one(&src, input_buf, vec->b_public_size);
3803 	sg_init_one(&dst, output_buf, out_len_max);
3804 	kpp_request_set_input(req, &src, vec->b_public_size);
3805 	kpp_request_set_output(req, &dst, out_len_max);
3806 	kpp_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG,
3807 				 crypto_req_done, &wait);
3808 	err = crypto_wait_req(crypto_kpp_compute_shared_secret(req), &wait);
3809 	if (err) {
3810 		pr_err("alg: %s: Party A: compute shared secret test failed. err %d\n",
3811 		       alg, err);
3812 		goto free_all;
3813 	}
3814 
3815 	if (vec->genkey) {
3816 		/* Save the shared secret obtained by party A */
3817 		a_ss = kmemdup(sg_virt(req->dst), vec->expected_ss_size, GFP_KERNEL);
3818 		if (!a_ss) {
3819 			err = -ENOMEM;
3820 			goto free_all;
3821 		}
3822 
3823 		/*
3824 		 * Calculate party B's shared secret by using party A's
3825 		 * public key.
3826 		 */
3827 		err = crypto_kpp_set_secret(tfm, vec->b_secret,
3828 					    vec->b_secret_size);
3829 		if (err < 0)
3830 			goto free_all;
3831 
3832 		sg_init_one(&src, a_public, vec->expected_a_public_size);
3833 		sg_init_one(&dst, output_buf, out_len_max);
3834 		kpp_request_set_input(req, &src, vec->expected_a_public_size);
3835 		kpp_request_set_output(req, &dst, out_len_max);
3836 		kpp_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG,
3837 					 crypto_req_done, &wait);
3838 		err = crypto_wait_req(crypto_kpp_compute_shared_secret(req),
3839 				      &wait);
3840 		if (err) {
3841 			pr_err("alg: %s: Party B: compute shared secret failed. err %d\n",
3842 			       alg, err);
3843 			goto free_all;
3844 		}
3845 
3846 		shared_secret = a_ss;
3847 	} else {
3848 		shared_secret = (void *)vec->expected_ss;
3849 	}
3850 
3851 	/*
3852 	 * verify shared secret from which the user will derive
3853 	 * secret key by executing whatever hash it has chosen
3854 	 */
3855 	if (memcmp(shared_secret, sg_virt(req->dst),
3856 		   vec->expected_ss_size)) {
3857 		pr_err("alg: %s: compute shared secret test failed. Invalid output\n",
3858 		       alg);
3859 		err = -EINVAL;
3860 	}
3861 
3862 free_all:
3863 	kfree(a_ss);
3864 	kfree(input_buf);
3865 free_output:
3866 	kfree(a_public);
3867 	kfree(output_buf);
3868 free_req:
3869 	kpp_request_free(req);
3870 	return err;
3871 }
3872 
3873 static int test_kpp(struct crypto_kpp *tfm, const char *alg,
3874 		    const struct kpp_testvec *vecs, unsigned int tcount)
3875 {
3876 	int ret, i;
3877 
3878 	for (i = 0; i < tcount; i++) {
3879 		ret = do_test_kpp(tfm, vecs++, alg);
3880 		if (ret) {
3881 			pr_err("alg: %s: test failed on vector %d, err=%d\n",
3882 			       alg, i + 1, ret);
3883 			return ret;
3884 		}
3885 	}
3886 	return 0;
3887 }
3888 
3889 static int alg_test_kpp(const struct alg_test_desc *desc, const char *driver,
3890 			u32 type, u32 mask)
3891 {
3892 	struct crypto_kpp *tfm;
3893 	int err = 0;
3894 
3895 	tfm = crypto_alloc_kpp(driver, type, mask);
3896 	if (IS_ERR(tfm)) {
3897 		pr_err("alg: kpp: Failed to load tfm for %s: %ld\n",
3898 		       driver, PTR_ERR(tfm));
3899 		return PTR_ERR(tfm);
3900 	}
3901 	if (desc->suite.kpp.vecs)
3902 		err = test_kpp(tfm, desc->alg, desc->suite.kpp.vecs,
3903 			       desc->suite.kpp.count);
3904 
3905 	crypto_free_kpp(tfm);
3906 	return err;
3907 }
3908 
3909 static u8 *test_pack_u32(u8 *dst, u32 val)
3910 {
3911 	memcpy(dst, &val, sizeof(val));
3912 	return dst + sizeof(val);
3913 }
3914 
3915 static int test_akcipher_one(struct crypto_akcipher *tfm,
3916 			     const struct akcipher_testvec *vecs)
3917 {
3918 	char *xbuf[XBUFSIZE];
3919 	struct akcipher_request *req;
3920 	void *outbuf_enc = NULL;
3921 	void *outbuf_dec = NULL;
3922 	struct crypto_wait wait;
3923 	unsigned int out_len_max, out_len = 0;
3924 	int err = -ENOMEM;
3925 	struct scatterlist src, dst, src_tab[3];
3926 	const char *m, *c;
3927 	unsigned int m_size, c_size;
3928 	const char *op;
3929 	u8 *key, *ptr;
3930 
3931 	if (testmgr_alloc_buf(xbuf))
3932 		return err;
3933 
3934 	req = akcipher_request_alloc(tfm, GFP_KERNEL);
3935 	if (!req)
3936 		goto free_xbuf;
3937 
3938 	crypto_init_wait(&wait);
3939 
3940 	key = kmalloc(vecs->key_len + sizeof(u32) * 2 + vecs->param_len,
3941 		      GFP_KERNEL);
3942 	if (!key)
3943 		goto free_req;
3944 	memcpy(key, vecs->key, vecs->key_len);
3945 	ptr = key + vecs->key_len;
3946 	ptr = test_pack_u32(ptr, vecs->algo);
3947 	ptr = test_pack_u32(ptr, vecs->param_len);
3948 	memcpy(ptr, vecs->params, vecs->param_len);
3949 
3950 	if (vecs->public_key_vec)
3951 		err = crypto_akcipher_set_pub_key(tfm, key, vecs->key_len);
3952 	else
3953 		err = crypto_akcipher_set_priv_key(tfm, key, vecs->key_len);
3954 	if (err)
3955 		goto free_key;
3956 
3957 	/*
3958 	 * First run test which do not require a private key, such as
3959 	 * encrypt or verify.
3960 	 */
3961 	err = -ENOMEM;
3962 	out_len_max = crypto_akcipher_maxsize(tfm);
3963 	outbuf_enc = kzalloc(out_len_max, GFP_KERNEL);
3964 	if (!outbuf_enc)
3965 		goto free_key;
3966 
3967 	if (!vecs->siggen_sigver_test) {
3968 		m = vecs->m;
3969 		m_size = vecs->m_size;
3970 		c = vecs->c;
3971 		c_size = vecs->c_size;
3972 		op = "encrypt";
3973 	} else {
3974 		/* Swap args so we could keep plaintext (digest)
3975 		 * in vecs->m, and cooked signature in vecs->c.
3976 		 */
3977 		m = vecs->c; /* signature */
3978 		m_size = vecs->c_size;
3979 		c = vecs->m; /* digest */
3980 		c_size = vecs->m_size;
3981 		op = "verify";
3982 	}
3983 
3984 	err = -E2BIG;
3985 	if (WARN_ON(m_size > PAGE_SIZE))
3986 		goto free_all;
3987 	memcpy(xbuf[0], m, m_size);
3988 
3989 	sg_init_table(src_tab, 3);
3990 	sg_set_buf(&src_tab[0], xbuf[0], 8);
3991 	sg_set_buf(&src_tab[1], xbuf[0] + 8, m_size - 8);
3992 	if (vecs->siggen_sigver_test) {
3993 		if (WARN_ON(c_size > PAGE_SIZE))
3994 			goto free_all;
3995 		memcpy(xbuf[1], c, c_size);
3996 		sg_set_buf(&src_tab[2], xbuf[1], c_size);
3997 		akcipher_request_set_crypt(req, src_tab, NULL, m_size, c_size);
3998 	} else {
3999 		sg_init_one(&dst, outbuf_enc, out_len_max);
4000 		akcipher_request_set_crypt(req, src_tab, &dst, m_size,
4001 					   out_len_max);
4002 	}
4003 	akcipher_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG,
4004 				      crypto_req_done, &wait);
4005 
4006 	err = crypto_wait_req(vecs->siggen_sigver_test ?
4007 			      /* Run asymmetric signature verification */
4008 			      crypto_akcipher_verify(req) :
4009 			      /* Run asymmetric encrypt */
4010 			      crypto_akcipher_encrypt(req), &wait);
4011 	if (err) {
4012 		pr_err("alg: akcipher: %s test failed. err %d\n", op, err);
4013 		goto free_all;
4014 	}
4015 	if (!vecs->siggen_sigver_test && c) {
4016 		if (req->dst_len != c_size) {
4017 			pr_err("alg: akcipher: %s test failed. Invalid output len\n",
4018 			       op);
4019 			err = -EINVAL;
4020 			goto free_all;
4021 		}
4022 		/* verify that encrypted message is equal to expected */
4023 		if (memcmp(c, outbuf_enc, c_size) != 0) {
4024 			pr_err("alg: akcipher: %s test failed. Invalid output\n",
4025 			       op);
4026 			hexdump(outbuf_enc, c_size);
4027 			err = -EINVAL;
4028 			goto free_all;
4029 		}
4030 	}
4031 
4032 	/*
4033 	 * Don't invoke (decrypt or sign) test which require a private key
4034 	 * for vectors with only a public key.
4035 	 */
4036 	if (vecs->public_key_vec) {
4037 		err = 0;
4038 		goto free_all;
4039 	}
4040 	outbuf_dec = kzalloc(out_len_max, GFP_KERNEL);
4041 	if (!outbuf_dec) {
4042 		err = -ENOMEM;
4043 		goto free_all;
4044 	}
4045 
4046 	if (!vecs->siggen_sigver_test && !c) {
4047 		c = outbuf_enc;
4048 		c_size = req->dst_len;
4049 	}
4050 
4051 	err = -E2BIG;
4052 	op = vecs->siggen_sigver_test ? "sign" : "decrypt";
4053 	if (WARN_ON(c_size > PAGE_SIZE))
4054 		goto free_all;
4055 	memcpy(xbuf[0], c, c_size);
4056 
4057 	sg_init_one(&src, xbuf[0], c_size);
4058 	sg_init_one(&dst, outbuf_dec, out_len_max);
4059 	crypto_init_wait(&wait);
4060 	akcipher_request_set_crypt(req, &src, &dst, c_size, out_len_max);
4061 
4062 	err = crypto_wait_req(vecs->siggen_sigver_test ?
4063 			      /* Run asymmetric signature generation */
4064 			      crypto_akcipher_sign(req) :
4065 			      /* Run asymmetric decrypt */
4066 			      crypto_akcipher_decrypt(req), &wait);
4067 	if (err) {
4068 		pr_err("alg: akcipher: %s test failed. err %d\n", op, err);
4069 		goto free_all;
4070 	}
4071 	out_len = req->dst_len;
4072 	if (out_len < m_size) {
4073 		pr_err("alg: akcipher: %s test failed. Invalid output len %u\n",
4074 		       op, out_len);
4075 		err = -EINVAL;
4076 		goto free_all;
4077 	}
4078 	/* verify that decrypted message is equal to the original msg */
4079 	if (memchr_inv(outbuf_dec, 0, out_len - m_size) ||
4080 	    memcmp(m, outbuf_dec + out_len - m_size, m_size)) {
4081 		pr_err("alg: akcipher: %s test failed. Invalid output\n", op);
4082 		hexdump(outbuf_dec, out_len);
4083 		err = -EINVAL;
4084 	}
4085 free_all:
4086 	kfree(outbuf_dec);
4087 	kfree(outbuf_enc);
4088 free_key:
4089 	kfree(key);
4090 free_req:
4091 	akcipher_request_free(req);
4092 free_xbuf:
4093 	testmgr_free_buf(xbuf);
4094 	return err;
4095 }
4096 
4097 static int test_akcipher(struct crypto_akcipher *tfm, const char *alg,
4098 			 const struct akcipher_testvec *vecs,
4099 			 unsigned int tcount)
4100 {
4101 	const char *algo =
4102 		crypto_tfm_alg_driver_name(crypto_akcipher_tfm(tfm));
4103 	int ret, i;
4104 
4105 	for (i = 0; i < tcount; i++) {
4106 		ret = test_akcipher_one(tfm, vecs++);
4107 		if (!ret)
4108 			continue;
4109 
4110 		pr_err("alg: akcipher: test %d failed for %s, err=%d\n",
4111 		       i + 1, algo, ret);
4112 		return ret;
4113 	}
4114 	return 0;
4115 }
4116 
4117 static int alg_test_akcipher(const struct alg_test_desc *desc,
4118 			     const char *driver, u32 type, u32 mask)
4119 {
4120 	struct crypto_akcipher *tfm;
4121 	int err = 0;
4122 
4123 	tfm = crypto_alloc_akcipher(driver, type, mask);
4124 	if (IS_ERR(tfm)) {
4125 		pr_err("alg: akcipher: Failed to load tfm for %s: %ld\n",
4126 		       driver, PTR_ERR(tfm));
4127 		return PTR_ERR(tfm);
4128 	}
4129 	if (desc->suite.akcipher.vecs)
4130 		err = test_akcipher(tfm, desc->alg, desc->suite.akcipher.vecs,
4131 				    desc->suite.akcipher.count);
4132 
4133 	crypto_free_akcipher(tfm);
4134 	return err;
4135 }
4136 
4137 static int alg_test_null(const struct alg_test_desc *desc,
4138 			     const char *driver, u32 type, u32 mask)
4139 {
4140 	return 0;
4141 }
4142 
4143 #define ____VECS(tv)	.vecs = tv, .count = ARRAY_SIZE(tv)
4144 #define __VECS(tv)	{ ____VECS(tv) }
4145 
4146 /* Please keep this list sorted by algorithm name. */
4147 static const struct alg_test_desc alg_test_descs[] = {
4148 	{
4149 		.alg = "adiantum(xchacha12,aes)",
4150 		.generic_driver = "adiantum(xchacha12-generic,aes-generic,nhpoly1305-generic)",
4151 		.test = alg_test_skcipher,
4152 		.suite = {
4153 			.cipher = __VECS(adiantum_xchacha12_aes_tv_template)
4154 		},
4155 	}, {
4156 		.alg = "adiantum(xchacha20,aes)",
4157 		.generic_driver = "adiantum(xchacha20-generic,aes-generic,nhpoly1305-generic)",
4158 		.test = alg_test_skcipher,
4159 		.suite = {
4160 			.cipher = __VECS(adiantum_xchacha20_aes_tv_template)
4161 		},
4162 	}, {
4163 		.alg = "aegis128",
4164 		.test = alg_test_aead,
4165 		.suite = {
4166 			.aead = __VECS(aegis128_tv_template)
4167 		}
4168 	}, {
4169 		.alg = "ansi_cprng",
4170 		.test = alg_test_cprng,
4171 		.suite = {
4172 			.cprng = __VECS(ansi_cprng_aes_tv_template)
4173 		}
4174 	}, {
4175 		.alg = "authenc(hmac(md5),ecb(cipher_null))",
4176 		.test = alg_test_aead,
4177 		.suite = {
4178 			.aead = __VECS(hmac_md5_ecb_cipher_null_tv_template)
4179 		}
4180 	}, {
4181 		.alg = "authenc(hmac(sha1),cbc(aes))",
4182 		.test = alg_test_aead,
4183 		.fips_allowed = 1,
4184 		.suite = {
4185 			.aead = __VECS(hmac_sha1_aes_cbc_tv_temp)
4186 		}
4187 	}, {
4188 		.alg = "authenc(hmac(sha1),cbc(des))",
4189 		.test = alg_test_aead,
4190 		.suite = {
4191 			.aead = __VECS(hmac_sha1_des_cbc_tv_temp)
4192 		}
4193 	}, {
4194 		.alg = "authenc(hmac(sha1),cbc(des3_ede))",
4195 		.test = alg_test_aead,
4196 		.suite = {
4197 			.aead = __VECS(hmac_sha1_des3_ede_cbc_tv_temp)
4198 		}
4199 	}, {
4200 		.alg = "authenc(hmac(sha1),ctr(aes))",
4201 		.test = alg_test_null,
4202 		.fips_allowed = 1,
4203 	}, {
4204 		.alg = "authenc(hmac(sha1),ecb(cipher_null))",
4205 		.test = alg_test_aead,
4206 		.suite = {
4207 			.aead = __VECS(hmac_sha1_ecb_cipher_null_tv_temp)
4208 		}
4209 	}, {
4210 		.alg = "authenc(hmac(sha1),rfc3686(ctr(aes)))",
4211 		.test = alg_test_null,
4212 		.fips_allowed = 1,
4213 	}, {
4214 		.alg = "authenc(hmac(sha224),cbc(des))",
4215 		.test = alg_test_aead,
4216 		.suite = {
4217 			.aead = __VECS(hmac_sha224_des_cbc_tv_temp)
4218 		}
4219 	}, {
4220 		.alg = "authenc(hmac(sha224),cbc(des3_ede))",
4221 		.test = alg_test_aead,
4222 		.suite = {
4223 			.aead = __VECS(hmac_sha224_des3_ede_cbc_tv_temp)
4224 		}
4225 	}, {
4226 		.alg = "authenc(hmac(sha256),cbc(aes))",
4227 		.test = alg_test_aead,
4228 		.fips_allowed = 1,
4229 		.suite = {
4230 			.aead = __VECS(hmac_sha256_aes_cbc_tv_temp)
4231 		}
4232 	}, {
4233 		.alg = "authenc(hmac(sha256),cbc(des))",
4234 		.test = alg_test_aead,
4235 		.suite = {
4236 			.aead = __VECS(hmac_sha256_des_cbc_tv_temp)
4237 		}
4238 	}, {
4239 		.alg = "authenc(hmac(sha256),cbc(des3_ede))",
4240 		.test = alg_test_aead,
4241 		.suite = {
4242 			.aead = __VECS(hmac_sha256_des3_ede_cbc_tv_temp)
4243 		}
4244 	}, {
4245 		.alg = "authenc(hmac(sha256),ctr(aes))",
4246 		.test = alg_test_null,
4247 		.fips_allowed = 1,
4248 	}, {
4249 		.alg = "authenc(hmac(sha256),rfc3686(ctr(aes)))",
4250 		.test = alg_test_null,
4251 		.fips_allowed = 1,
4252 	}, {
4253 		.alg = "authenc(hmac(sha384),cbc(des))",
4254 		.test = alg_test_aead,
4255 		.suite = {
4256 			.aead = __VECS(hmac_sha384_des_cbc_tv_temp)
4257 		}
4258 	}, {
4259 		.alg = "authenc(hmac(sha384),cbc(des3_ede))",
4260 		.test = alg_test_aead,
4261 		.suite = {
4262 			.aead = __VECS(hmac_sha384_des3_ede_cbc_tv_temp)
4263 		}
4264 	}, {
4265 		.alg = "authenc(hmac(sha384),ctr(aes))",
4266 		.test = alg_test_null,
4267 		.fips_allowed = 1,
4268 	}, {
4269 		.alg = "authenc(hmac(sha384),rfc3686(ctr(aes)))",
4270 		.test = alg_test_null,
4271 		.fips_allowed = 1,
4272 	}, {
4273 		.alg = "authenc(hmac(sha512),cbc(aes))",
4274 		.fips_allowed = 1,
4275 		.test = alg_test_aead,
4276 		.suite = {
4277 			.aead = __VECS(hmac_sha512_aes_cbc_tv_temp)
4278 		}
4279 	}, {
4280 		.alg = "authenc(hmac(sha512),cbc(des))",
4281 		.test = alg_test_aead,
4282 		.suite = {
4283 			.aead = __VECS(hmac_sha512_des_cbc_tv_temp)
4284 		}
4285 	}, {
4286 		.alg = "authenc(hmac(sha512),cbc(des3_ede))",
4287 		.test = alg_test_aead,
4288 		.suite = {
4289 			.aead = __VECS(hmac_sha512_des3_ede_cbc_tv_temp)
4290 		}
4291 	}, {
4292 		.alg = "authenc(hmac(sha512),ctr(aes))",
4293 		.test = alg_test_null,
4294 		.fips_allowed = 1,
4295 	}, {
4296 		.alg = "authenc(hmac(sha512),rfc3686(ctr(aes)))",
4297 		.test = alg_test_null,
4298 		.fips_allowed = 1,
4299 	}, {
4300 		.alg = "blake2b-160",
4301 		.test = alg_test_hash,
4302 		.fips_allowed = 0,
4303 		.suite = {
4304 			.hash = __VECS(blake2b_160_tv_template)
4305 		}
4306 	}, {
4307 		.alg = "blake2b-256",
4308 		.test = alg_test_hash,
4309 		.fips_allowed = 0,
4310 		.suite = {
4311 			.hash = __VECS(blake2b_256_tv_template)
4312 		}
4313 	}, {
4314 		.alg = "blake2b-384",
4315 		.test = alg_test_hash,
4316 		.fips_allowed = 0,
4317 		.suite = {
4318 			.hash = __VECS(blake2b_384_tv_template)
4319 		}
4320 	}, {
4321 		.alg = "blake2b-512",
4322 		.test = alg_test_hash,
4323 		.fips_allowed = 0,
4324 		.suite = {
4325 			.hash = __VECS(blake2b_512_tv_template)
4326 		}
4327 	}, {
4328 		.alg = "blake2s-128",
4329 		.test = alg_test_hash,
4330 		.suite = {
4331 			.hash = __VECS(blakes2s_128_tv_template)
4332 		}
4333 	}, {
4334 		.alg = "blake2s-160",
4335 		.test = alg_test_hash,
4336 		.suite = {
4337 			.hash = __VECS(blakes2s_160_tv_template)
4338 		}
4339 	}, {
4340 		.alg = "blake2s-224",
4341 		.test = alg_test_hash,
4342 		.suite = {
4343 			.hash = __VECS(blakes2s_224_tv_template)
4344 		}
4345 	}, {
4346 		.alg = "blake2s-256",
4347 		.test = alg_test_hash,
4348 		.suite = {
4349 			.hash = __VECS(blakes2s_256_tv_template)
4350 		}
4351 	}, {
4352 		.alg = "cbc(aes)",
4353 		.test = alg_test_skcipher,
4354 		.fips_allowed = 1,
4355 		.suite = {
4356 			.cipher = __VECS(aes_cbc_tv_template)
4357 		},
4358 	}, {
4359 		.alg = "cbc(anubis)",
4360 		.test = alg_test_skcipher,
4361 		.suite = {
4362 			.cipher = __VECS(anubis_cbc_tv_template)
4363 		},
4364 	}, {
4365 		.alg = "cbc(blowfish)",
4366 		.test = alg_test_skcipher,
4367 		.suite = {
4368 			.cipher = __VECS(bf_cbc_tv_template)
4369 		},
4370 	}, {
4371 		.alg = "cbc(camellia)",
4372 		.test = alg_test_skcipher,
4373 		.suite = {
4374 			.cipher = __VECS(camellia_cbc_tv_template)
4375 		},
4376 	}, {
4377 		.alg = "cbc(cast5)",
4378 		.test = alg_test_skcipher,
4379 		.suite = {
4380 			.cipher = __VECS(cast5_cbc_tv_template)
4381 		},
4382 	}, {
4383 		.alg = "cbc(cast6)",
4384 		.test = alg_test_skcipher,
4385 		.suite = {
4386 			.cipher = __VECS(cast6_cbc_tv_template)
4387 		},
4388 	}, {
4389 		.alg = "cbc(des)",
4390 		.test = alg_test_skcipher,
4391 		.suite = {
4392 			.cipher = __VECS(des_cbc_tv_template)
4393 		},
4394 	}, {
4395 		.alg = "cbc(des3_ede)",
4396 		.test = alg_test_skcipher,
4397 		.suite = {
4398 			.cipher = __VECS(des3_ede_cbc_tv_template)
4399 		},
4400 	}, {
4401 		/* Same as cbc(aes) except the key is stored in
4402 		 * hardware secure memory which we reference by index
4403 		 */
4404 		.alg = "cbc(paes)",
4405 		.test = alg_test_null,
4406 		.fips_allowed = 1,
4407 	}, {
4408 		/* Same as cbc(sm4) except the key is stored in
4409 		 * hardware secure memory which we reference by index
4410 		 */
4411 		.alg = "cbc(psm4)",
4412 		.test = alg_test_null,
4413 	}, {
4414 		.alg = "cbc(serpent)",
4415 		.test = alg_test_skcipher,
4416 		.suite = {
4417 			.cipher = __VECS(serpent_cbc_tv_template)
4418 		},
4419 	}, {
4420 		.alg = "cbc(sm4)",
4421 		.test = alg_test_skcipher,
4422 		.suite = {
4423 			.cipher = __VECS(sm4_cbc_tv_template)
4424 		}
4425 	}, {
4426 		.alg = "cbc(twofish)",
4427 		.test = alg_test_skcipher,
4428 		.suite = {
4429 			.cipher = __VECS(tf_cbc_tv_template)
4430 		},
4431 	}, {
4432 #if IS_ENABLED(CONFIG_CRYPTO_PAES_S390)
4433 		.alg = "cbc-paes-s390",
4434 		.fips_allowed = 1,
4435 		.test = alg_test_skcipher,
4436 		.suite = {
4437 			.cipher = __VECS(aes_cbc_tv_template)
4438 		}
4439 	}, {
4440 #endif
4441 		.alg = "cbcmac(aes)",
4442 		.fips_allowed = 1,
4443 		.test = alg_test_hash,
4444 		.suite = {
4445 			.hash = __VECS(aes_cbcmac_tv_template)
4446 		}
4447 	}, {
4448 		.alg = "cbcmac(sm4)",
4449 		.test = alg_test_hash,
4450 		.suite = {
4451 			.hash = __VECS(sm4_cbcmac_tv_template)
4452 		}
4453 	}, {
4454 		.alg = "ccm(aes)",
4455 		.generic_driver = "ccm_base(ctr(aes-generic),cbcmac(aes-generic))",
4456 		.test = alg_test_aead,
4457 		.fips_allowed = 1,
4458 		.suite = {
4459 			.aead = {
4460 				____VECS(aes_ccm_tv_template),
4461 				.einval_allowed = 1,
4462 			}
4463 		}
4464 	}, {
4465 		.alg = "ccm(sm4)",
4466 		.generic_driver = "ccm_base(ctr(sm4-generic),cbcmac(sm4-generic))",
4467 		.test = alg_test_aead,
4468 		.suite = {
4469 			.aead = {
4470 				____VECS(sm4_ccm_tv_template),
4471 				.einval_allowed = 1,
4472 			}
4473 		}
4474 	}, {
4475 		.alg = "cfb(aes)",
4476 		.test = alg_test_skcipher,
4477 		.fips_allowed = 1,
4478 		.suite = {
4479 			.cipher = __VECS(aes_cfb_tv_template)
4480 		},
4481 	}, {
4482 		.alg = "cfb(sm4)",
4483 		.test = alg_test_skcipher,
4484 		.suite = {
4485 			.cipher = __VECS(sm4_cfb_tv_template)
4486 		}
4487 	}, {
4488 		.alg = "chacha20",
4489 		.test = alg_test_skcipher,
4490 		.suite = {
4491 			.cipher = __VECS(chacha20_tv_template)
4492 		},
4493 	}, {
4494 		.alg = "cmac(aes)",
4495 		.fips_allowed = 1,
4496 		.test = alg_test_hash,
4497 		.suite = {
4498 			.hash = __VECS(aes_cmac128_tv_template)
4499 		}
4500 	}, {
4501 		.alg = "cmac(des3_ede)",
4502 		.test = alg_test_hash,
4503 		.suite = {
4504 			.hash = __VECS(des3_ede_cmac64_tv_template)
4505 		}
4506 	}, {
4507 		.alg = "cmac(sm4)",
4508 		.test = alg_test_hash,
4509 		.suite = {
4510 			.hash = __VECS(sm4_cmac128_tv_template)
4511 		}
4512 	}, {
4513 		.alg = "compress_null",
4514 		.test = alg_test_null,
4515 	}, {
4516 		.alg = "crc32",
4517 		.test = alg_test_hash,
4518 		.fips_allowed = 1,
4519 		.suite = {
4520 			.hash = __VECS(crc32_tv_template)
4521 		}
4522 	}, {
4523 		.alg = "crc32c",
4524 		.test = alg_test_crc32c,
4525 		.fips_allowed = 1,
4526 		.suite = {
4527 			.hash = __VECS(crc32c_tv_template)
4528 		}
4529 	}, {
4530 		.alg = "crct10dif",
4531 		.test = alg_test_hash,
4532 		.fips_allowed = 1,
4533 		.suite = {
4534 			.hash = __VECS(crct10dif_tv_template)
4535 		}
4536 	}, {
4537 		.alg = "ctr(aes)",
4538 		.test = alg_test_skcipher,
4539 		.fips_allowed = 1,
4540 		.suite = {
4541 			.cipher = __VECS(aes_ctr_tv_template)
4542 		}
4543 	}, {
4544 		.alg = "ctr(blowfish)",
4545 		.test = alg_test_skcipher,
4546 		.suite = {
4547 			.cipher = __VECS(bf_ctr_tv_template)
4548 		}
4549 	}, {
4550 		.alg = "ctr(camellia)",
4551 		.test = alg_test_skcipher,
4552 		.suite = {
4553 			.cipher = __VECS(camellia_ctr_tv_template)
4554 		}
4555 	}, {
4556 		.alg = "ctr(cast5)",
4557 		.test = alg_test_skcipher,
4558 		.suite = {
4559 			.cipher = __VECS(cast5_ctr_tv_template)
4560 		}
4561 	}, {
4562 		.alg = "ctr(cast6)",
4563 		.test = alg_test_skcipher,
4564 		.suite = {
4565 			.cipher = __VECS(cast6_ctr_tv_template)
4566 		}
4567 	}, {
4568 		.alg = "ctr(des)",
4569 		.test = alg_test_skcipher,
4570 		.suite = {
4571 			.cipher = __VECS(des_ctr_tv_template)
4572 		}
4573 	}, {
4574 		.alg = "ctr(des3_ede)",
4575 		.test = alg_test_skcipher,
4576 		.suite = {
4577 			.cipher = __VECS(des3_ede_ctr_tv_template)
4578 		}
4579 	}, {
4580 		/* Same as ctr(aes) except the key is stored in
4581 		 * hardware secure memory which we reference by index
4582 		 */
4583 		.alg = "ctr(paes)",
4584 		.test = alg_test_null,
4585 		.fips_allowed = 1,
4586 	}, {
4587 
4588 		/* Same as ctr(sm4) except the key is stored in
4589 		 * hardware secure memory which we reference by index
4590 		 */
4591 		.alg = "ctr(psm4)",
4592 		.test = alg_test_null,
4593 	}, {
4594 		.alg = "ctr(serpent)",
4595 		.test = alg_test_skcipher,
4596 		.suite = {
4597 			.cipher = __VECS(serpent_ctr_tv_template)
4598 		}
4599 	}, {
4600 		.alg = "ctr(sm4)",
4601 		.test = alg_test_skcipher,
4602 		.suite = {
4603 			.cipher = __VECS(sm4_ctr_tv_template)
4604 		}
4605 	}, {
4606 		.alg = "ctr(twofish)",
4607 		.test = alg_test_skcipher,
4608 		.suite = {
4609 			.cipher = __VECS(tf_ctr_tv_template)
4610 		}
4611 	}, {
4612 #if IS_ENABLED(CONFIG_CRYPTO_PAES_S390)
4613 		.alg = "ctr-paes-s390",
4614 		.fips_allowed = 1,
4615 		.test = alg_test_skcipher,
4616 		.suite = {
4617 			.cipher = __VECS(aes_ctr_tv_template)
4618 		}
4619 	}, {
4620 #endif
4621 		.alg = "cts(cbc(aes))",
4622 		.test = alg_test_skcipher,
4623 		.fips_allowed = 1,
4624 		.suite = {
4625 			.cipher = __VECS(cts_mode_tv_template)
4626 		}
4627 	}, {
4628 		/* Same as cts(cbc((aes)) except the key is stored in
4629 		 * hardware secure memory which we reference by index
4630 		 */
4631 		.alg = "cts(cbc(paes))",
4632 		.test = alg_test_null,
4633 		.fips_allowed = 1,
4634 	}, {
4635 		.alg = "curve25519",
4636 		.test = alg_test_kpp,
4637 		.suite = {
4638 			.kpp = __VECS(curve25519_tv_template)
4639 		}
4640 	}, {
4641 		.alg = "deflate",
4642 		.test = alg_test_comp,
4643 		.fips_allowed = 1,
4644 		.suite = {
4645 			.comp = {
4646 				.comp = __VECS(deflate_comp_tv_template),
4647 				.decomp = __VECS(deflate_decomp_tv_template)
4648 			}
4649 		}
4650 	}, {
4651 		.alg = "dh",
4652 		.test = alg_test_kpp,
4653 		.fips_allowed = 1,
4654 		.suite = {
4655 			.kpp = __VECS(dh_tv_template)
4656 		}
4657 	}, {
4658 		.alg = "digest_null",
4659 		.test = alg_test_null,
4660 	}, {
4661 		.alg = "drbg_nopr_ctr_aes128",
4662 		.test = alg_test_drbg,
4663 		.fips_allowed = 1,
4664 		.suite = {
4665 			.drbg = __VECS(drbg_nopr_ctr_aes128_tv_template)
4666 		}
4667 	}, {
4668 		.alg = "drbg_nopr_ctr_aes192",
4669 		.test = alg_test_drbg,
4670 		.fips_allowed = 1,
4671 		.suite = {
4672 			.drbg = __VECS(drbg_nopr_ctr_aes192_tv_template)
4673 		}
4674 	}, {
4675 		.alg = "drbg_nopr_ctr_aes256",
4676 		.test = alg_test_drbg,
4677 		.fips_allowed = 1,
4678 		.suite = {
4679 			.drbg = __VECS(drbg_nopr_ctr_aes256_tv_template)
4680 		}
4681 	}, {
4682 		/*
4683 		 * There is no need to specifically test the DRBG with every
4684 		 * backend cipher -- covered by drbg_nopr_hmac_sha256 test
4685 		 */
4686 		.alg = "drbg_nopr_hmac_sha1",
4687 		.fips_allowed = 1,
4688 		.test = alg_test_null,
4689 	}, {
4690 		.alg = "drbg_nopr_hmac_sha256",
4691 		.test = alg_test_drbg,
4692 		.fips_allowed = 1,
4693 		.suite = {
4694 			.drbg = __VECS(drbg_nopr_hmac_sha256_tv_template)
4695 		}
4696 	}, {
4697 		/* covered by drbg_nopr_hmac_sha256 test */
4698 		.alg = "drbg_nopr_hmac_sha384",
4699 		.fips_allowed = 1,
4700 		.test = alg_test_null,
4701 	}, {
4702 		.alg = "drbg_nopr_hmac_sha512",
4703 		.test = alg_test_drbg,
4704 		.fips_allowed = 1,
4705 		.suite = {
4706 			.drbg = __VECS(drbg_nopr_hmac_sha512_tv_template)
4707 		}
4708 	}, {
4709 		.alg = "drbg_nopr_sha1",
4710 		.fips_allowed = 1,
4711 		.test = alg_test_null,
4712 	}, {
4713 		.alg = "drbg_nopr_sha256",
4714 		.test = alg_test_drbg,
4715 		.fips_allowed = 1,
4716 		.suite = {
4717 			.drbg = __VECS(drbg_nopr_sha256_tv_template)
4718 		}
4719 	}, {
4720 		/* covered by drbg_nopr_sha256 test */
4721 		.alg = "drbg_nopr_sha384",
4722 		.fips_allowed = 1,
4723 		.test = alg_test_null,
4724 	}, {
4725 		.alg = "drbg_nopr_sha512",
4726 		.fips_allowed = 1,
4727 		.test = alg_test_null,
4728 	}, {
4729 		.alg = "drbg_pr_ctr_aes128",
4730 		.test = alg_test_drbg,
4731 		.fips_allowed = 1,
4732 		.suite = {
4733 			.drbg = __VECS(drbg_pr_ctr_aes128_tv_template)
4734 		}
4735 	}, {
4736 		/* covered by drbg_pr_ctr_aes128 test */
4737 		.alg = "drbg_pr_ctr_aes192",
4738 		.fips_allowed = 1,
4739 		.test = alg_test_null,
4740 	}, {
4741 		.alg = "drbg_pr_ctr_aes256",
4742 		.fips_allowed = 1,
4743 		.test = alg_test_null,
4744 	}, {
4745 		.alg = "drbg_pr_hmac_sha1",
4746 		.fips_allowed = 1,
4747 		.test = alg_test_null,
4748 	}, {
4749 		.alg = "drbg_pr_hmac_sha256",
4750 		.test = alg_test_drbg,
4751 		.fips_allowed = 1,
4752 		.suite = {
4753 			.drbg = __VECS(drbg_pr_hmac_sha256_tv_template)
4754 		}
4755 	}, {
4756 		/* covered by drbg_pr_hmac_sha256 test */
4757 		.alg = "drbg_pr_hmac_sha384",
4758 		.fips_allowed = 1,
4759 		.test = alg_test_null,
4760 	}, {
4761 		.alg = "drbg_pr_hmac_sha512",
4762 		.test = alg_test_null,
4763 		.fips_allowed = 1,
4764 	}, {
4765 		.alg = "drbg_pr_sha1",
4766 		.fips_allowed = 1,
4767 		.test = alg_test_null,
4768 	}, {
4769 		.alg = "drbg_pr_sha256",
4770 		.test = alg_test_drbg,
4771 		.fips_allowed = 1,
4772 		.suite = {
4773 			.drbg = __VECS(drbg_pr_sha256_tv_template)
4774 		}
4775 	}, {
4776 		/* covered by drbg_pr_sha256 test */
4777 		.alg = "drbg_pr_sha384",
4778 		.fips_allowed = 1,
4779 		.test = alg_test_null,
4780 	}, {
4781 		.alg = "drbg_pr_sha512",
4782 		.fips_allowed = 1,
4783 		.test = alg_test_null,
4784 	}, {
4785 		.alg = "ecb(aes)",
4786 		.test = alg_test_skcipher,
4787 		.fips_allowed = 1,
4788 		.suite = {
4789 			.cipher = __VECS(aes_tv_template)
4790 		}
4791 	}, {
4792 		.alg = "ecb(anubis)",
4793 		.test = alg_test_skcipher,
4794 		.suite = {
4795 			.cipher = __VECS(anubis_tv_template)
4796 		}
4797 	}, {
4798 		.alg = "ecb(arc4)",
4799 		.generic_driver = "ecb(arc4)-generic",
4800 		.test = alg_test_skcipher,
4801 		.suite = {
4802 			.cipher = __VECS(arc4_tv_template)
4803 		}
4804 	}, {
4805 		.alg = "ecb(blowfish)",
4806 		.test = alg_test_skcipher,
4807 		.suite = {
4808 			.cipher = __VECS(bf_tv_template)
4809 		}
4810 	}, {
4811 		.alg = "ecb(camellia)",
4812 		.test = alg_test_skcipher,
4813 		.suite = {
4814 			.cipher = __VECS(camellia_tv_template)
4815 		}
4816 	}, {
4817 		.alg = "ecb(cast5)",
4818 		.test = alg_test_skcipher,
4819 		.suite = {
4820 			.cipher = __VECS(cast5_tv_template)
4821 		}
4822 	}, {
4823 		.alg = "ecb(cast6)",
4824 		.test = alg_test_skcipher,
4825 		.suite = {
4826 			.cipher = __VECS(cast6_tv_template)
4827 		}
4828 	}, {
4829 		.alg = "ecb(cipher_null)",
4830 		.test = alg_test_null,
4831 		.fips_allowed = 1,
4832 	}, {
4833 		.alg = "ecb(des)",
4834 		.test = alg_test_skcipher,
4835 		.suite = {
4836 			.cipher = __VECS(des_tv_template)
4837 		}
4838 	}, {
4839 		.alg = "ecb(des3_ede)",
4840 		.test = alg_test_skcipher,
4841 		.suite = {
4842 			.cipher = __VECS(des3_ede_tv_template)
4843 		}
4844 	}, {
4845 		.alg = "ecb(fcrypt)",
4846 		.test = alg_test_skcipher,
4847 		.suite = {
4848 			.cipher = {
4849 				.vecs = fcrypt_pcbc_tv_template,
4850 				.count = 1
4851 			}
4852 		}
4853 	}, {
4854 		.alg = "ecb(khazad)",
4855 		.test = alg_test_skcipher,
4856 		.suite = {
4857 			.cipher = __VECS(khazad_tv_template)
4858 		}
4859 	}, {
4860 		/* Same as ecb(aes) except the key is stored in
4861 		 * hardware secure memory which we reference by index
4862 		 */
4863 		.alg = "ecb(paes)",
4864 		.test = alg_test_null,
4865 		.fips_allowed = 1,
4866 	}, {
4867 		.alg = "ecb(seed)",
4868 		.test = alg_test_skcipher,
4869 		.suite = {
4870 			.cipher = __VECS(seed_tv_template)
4871 		}
4872 	}, {
4873 		.alg = "ecb(serpent)",
4874 		.test = alg_test_skcipher,
4875 		.suite = {
4876 			.cipher = __VECS(serpent_tv_template)
4877 		}
4878 	}, {
4879 		.alg = "ecb(sm4)",
4880 		.test = alg_test_skcipher,
4881 		.suite = {
4882 			.cipher = __VECS(sm4_tv_template)
4883 		}
4884 	}, {
4885 		.alg = "ecb(tea)",
4886 		.test = alg_test_skcipher,
4887 		.suite = {
4888 			.cipher = __VECS(tea_tv_template)
4889 		}
4890 	}, {
4891 		.alg = "ecb(twofish)",
4892 		.test = alg_test_skcipher,
4893 		.suite = {
4894 			.cipher = __VECS(tf_tv_template)
4895 		}
4896 	}, {
4897 		.alg = "ecb(xeta)",
4898 		.test = alg_test_skcipher,
4899 		.suite = {
4900 			.cipher = __VECS(xeta_tv_template)
4901 		}
4902 	}, {
4903 		.alg = "ecb(xtea)",
4904 		.test = alg_test_skcipher,
4905 		.suite = {
4906 			.cipher = __VECS(xtea_tv_template)
4907 		}
4908 	}, {
4909 #if IS_ENABLED(CONFIG_CRYPTO_PAES_S390)
4910 		.alg = "ecb-paes-s390",
4911 		.fips_allowed = 1,
4912 		.test = alg_test_skcipher,
4913 		.suite = {
4914 			.cipher = __VECS(aes_tv_template)
4915 		}
4916 	}, {
4917 #endif
4918 		.alg = "ecdh-nist-p192",
4919 		.test = alg_test_kpp,
4920 		.suite = {
4921 			.kpp = __VECS(ecdh_p192_tv_template)
4922 		}
4923 	}, {
4924 		.alg = "ecdh-nist-p256",
4925 		.test = alg_test_kpp,
4926 		.fips_allowed = 1,
4927 		.suite = {
4928 			.kpp = __VECS(ecdh_p256_tv_template)
4929 		}
4930 	}, {
4931 		.alg = "ecdh-nist-p384",
4932 		.test = alg_test_kpp,
4933 		.fips_allowed = 1,
4934 		.suite = {
4935 			.kpp = __VECS(ecdh_p384_tv_template)
4936 		}
4937 	}, {
4938 		.alg = "ecdsa-nist-p192",
4939 		.test = alg_test_akcipher,
4940 		.suite = {
4941 			.akcipher = __VECS(ecdsa_nist_p192_tv_template)
4942 		}
4943 	}, {
4944 		.alg = "ecdsa-nist-p256",
4945 		.test = alg_test_akcipher,
4946 		.suite = {
4947 			.akcipher = __VECS(ecdsa_nist_p256_tv_template)
4948 		}
4949 	}, {
4950 		.alg = "ecdsa-nist-p384",
4951 		.test = alg_test_akcipher,
4952 		.suite = {
4953 			.akcipher = __VECS(ecdsa_nist_p384_tv_template)
4954 		}
4955 	}, {
4956 		.alg = "ecrdsa",
4957 		.test = alg_test_akcipher,
4958 		.suite = {
4959 			.akcipher = __VECS(ecrdsa_tv_template)
4960 		}
4961 	}, {
4962 		.alg = "essiv(authenc(hmac(sha256),cbc(aes)),sha256)",
4963 		.test = alg_test_aead,
4964 		.fips_allowed = 1,
4965 		.suite = {
4966 			.aead = __VECS(essiv_hmac_sha256_aes_cbc_tv_temp)
4967 		}
4968 	}, {
4969 		.alg = "essiv(cbc(aes),sha256)",
4970 		.test = alg_test_skcipher,
4971 		.fips_allowed = 1,
4972 		.suite = {
4973 			.cipher = __VECS(essiv_aes_cbc_tv_template)
4974 		}
4975 	}, {
4976 		.alg = "gcm(aes)",
4977 		.generic_driver = "gcm_base(ctr(aes-generic),ghash-generic)",
4978 		.test = alg_test_aead,
4979 		.fips_allowed = 1,
4980 		.suite = {
4981 			.aead = __VECS(aes_gcm_tv_template)
4982 		}
4983 	}, {
4984 		.alg = "gcm(sm4)",
4985 		.generic_driver = "gcm_base(ctr(sm4-generic),ghash-generic)",
4986 		.test = alg_test_aead,
4987 		.suite = {
4988 			.aead = __VECS(sm4_gcm_tv_template)
4989 		}
4990 	}, {
4991 		.alg = "ghash",
4992 		.test = alg_test_hash,
4993 		.fips_allowed = 1,
4994 		.suite = {
4995 			.hash = __VECS(ghash_tv_template)
4996 		}
4997 	}, {
4998 		.alg = "hmac(md5)",
4999 		.test = alg_test_hash,
5000 		.suite = {
5001 			.hash = __VECS(hmac_md5_tv_template)
5002 		}
5003 	}, {
5004 		.alg = "hmac(rmd160)",
5005 		.test = alg_test_hash,
5006 		.suite = {
5007 			.hash = __VECS(hmac_rmd160_tv_template)
5008 		}
5009 	}, {
5010 		.alg = "hmac(sha1)",
5011 		.test = alg_test_hash,
5012 		.fips_allowed = 1,
5013 		.suite = {
5014 			.hash = __VECS(hmac_sha1_tv_template)
5015 		}
5016 	}, {
5017 		.alg = "hmac(sha224)",
5018 		.test = alg_test_hash,
5019 		.fips_allowed = 1,
5020 		.suite = {
5021 			.hash = __VECS(hmac_sha224_tv_template)
5022 		}
5023 	}, {
5024 		.alg = "hmac(sha256)",
5025 		.test = alg_test_hash,
5026 		.fips_allowed = 1,
5027 		.suite = {
5028 			.hash = __VECS(hmac_sha256_tv_template)
5029 		}
5030 	}, {
5031 		.alg = "hmac(sha3-224)",
5032 		.test = alg_test_hash,
5033 		.fips_allowed = 1,
5034 		.suite = {
5035 			.hash = __VECS(hmac_sha3_224_tv_template)
5036 		}
5037 	}, {
5038 		.alg = "hmac(sha3-256)",
5039 		.test = alg_test_hash,
5040 		.fips_allowed = 1,
5041 		.suite = {
5042 			.hash = __VECS(hmac_sha3_256_tv_template)
5043 		}
5044 	}, {
5045 		.alg = "hmac(sha3-384)",
5046 		.test = alg_test_hash,
5047 		.fips_allowed = 1,
5048 		.suite = {
5049 			.hash = __VECS(hmac_sha3_384_tv_template)
5050 		}
5051 	}, {
5052 		.alg = "hmac(sha3-512)",
5053 		.test = alg_test_hash,
5054 		.fips_allowed = 1,
5055 		.suite = {
5056 			.hash = __VECS(hmac_sha3_512_tv_template)
5057 		}
5058 	}, {
5059 		.alg = "hmac(sha384)",
5060 		.test = alg_test_hash,
5061 		.fips_allowed = 1,
5062 		.suite = {
5063 			.hash = __VECS(hmac_sha384_tv_template)
5064 		}
5065 	}, {
5066 		.alg = "hmac(sha512)",
5067 		.test = alg_test_hash,
5068 		.fips_allowed = 1,
5069 		.suite = {
5070 			.hash = __VECS(hmac_sha512_tv_template)
5071 		}
5072 	}, {
5073 		.alg = "hmac(sm3)",
5074 		.test = alg_test_hash,
5075 		.suite = {
5076 			.hash = __VECS(hmac_sm3_tv_template)
5077 		}
5078 	}, {
5079 		.alg = "hmac(streebog256)",
5080 		.test = alg_test_hash,
5081 		.suite = {
5082 			.hash = __VECS(hmac_streebog256_tv_template)
5083 		}
5084 	}, {
5085 		.alg = "hmac(streebog512)",
5086 		.test = alg_test_hash,
5087 		.suite = {
5088 			.hash = __VECS(hmac_streebog512_tv_template)
5089 		}
5090 	}, {
5091 		.alg = "jitterentropy_rng",
5092 		.fips_allowed = 1,
5093 		.test = alg_test_null,
5094 	}, {
5095 		.alg = "kw(aes)",
5096 		.test = alg_test_skcipher,
5097 		.fips_allowed = 1,
5098 		.suite = {
5099 			.cipher = __VECS(aes_kw_tv_template)
5100 		}
5101 	}, {
5102 		.alg = "lrw(aes)",
5103 		.generic_driver = "lrw(ecb(aes-generic))",
5104 		.test = alg_test_skcipher,
5105 		.suite = {
5106 			.cipher = __VECS(aes_lrw_tv_template)
5107 		}
5108 	}, {
5109 		.alg = "lrw(camellia)",
5110 		.generic_driver = "lrw(ecb(camellia-generic))",
5111 		.test = alg_test_skcipher,
5112 		.suite = {
5113 			.cipher = __VECS(camellia_lrw_tv_template)
5114 		}
5115 	}, {
5116 		.alg = "lrw(cast6)",
5117 		.generic_driver = "lrw(ecb(cast6-generic))",
5118 		.test = alg_test_skcipher,
5119 		.suite = {
5120 			.cipher = __VECS(cast6_lrw_tv_template)
5121 		}
5122 	}, {
5123 		.alg = "lrw(serpent)",
5124 		.generic_driver = "lrw(ecb(serpent-generic))",
5125 		.test = alg_test_skcipher,
5126 		.suite = {
5127 			.cipher = __VECS(serpent_lrw_tv_template)
5128 		}
5129 	}, {
5130 		.alg = "lrw(twofish)",
5131 		.generic_driver = "lrw(ecb(twofish-generic))",
5132 		.test = alg_test_skcipher,
5133 		.suite = {
5134 			.cipher = __VECS(tf_lrw_tv_template)
5135 		}
5136 	}, {
5137 		.alg = "lz4",
5138 		.test = alg_test_comp,
5139 		.fips_allowed = 1,
5140 		.suite = {
5141 			.comp = {
5142 				.comp = __VECS(lz4_comp_tv_template),
5143 				.decomp = __VECS(lz4_decomp_tv_template)
5144 			}
5145 		}
5146 	}, {
5147 		.alg = "lz4hc",
5148 		.test = alg_test_comp,
5149 		.fips_allowed = 1,
5150 		.suite = {
5151 			.comp = {
5152 				.comp = __VECS(lz4hc_comp_tv_template),
5153 				.decomp = __VECS(lz4hc_decomp_tv_template)
5154 			}
5155 		}
5156 	}, {
5157 		.alg = "lzo",
5158 		.test = alg_test_comp,
5159 		.fips_allowed = 1,
5160 		.suite = {
5161 			.comp = {
5162 				.comp = __VECS(lzo_comp_tv_template),
5163 				.decomp = __VECS(lzo_decomp_tv_template)
5164 			}
5165 		}
5166 	}, {
5167 		.alg = "lzo-rle",
5168 		.test = alg_test_comp,
5169 		.fips_allowed = 1,
5170 		.suite = {
5171 			.comp = {
5172 				.comp = __VECS(lzorle_comp_tv_template),
5173 				.decomp = __VECS(lzorle_decomp_tv_template)
5174 			}
5175 		}
5176 	}, {
5177 		.alg = "md4",
5178 		.test = alg_test_hash,
5179 		.suite = {
5180 			.hash = __VECS(md4_tv_template)
5181 		}
5182 	}, {
5183 		.alg = "md5",
5184 		.test = alg_test_hash,
5185 		.suite = {
5186 			.hash = __VECS(md5_tv_template)
5187 		}
5188 	}, {
5189 		.alg = "michael_mic",
5190 		.test = alg_test_hash,
5191 		.suite = {
5192 			.hash = __VECS(michael_mic_tv_template)
5193 		}
5194 	}, {
5195 		.alg = "nhpoly1305",
5196 		.test = alg_test_hash,
5197 		.suite = {
5198 			.hash = __VECS(nhpoly1305_tv_template)
5199 		}
5200 	}, {
5201 		.alg = "ofb(aes)",
5202 		.test = alg_test_skcipher,
5203 		.fips_allowed = 1,
5204 		.suite = {
5205 			.cipher = __VECS(aes_ofb_tv_template)
5206 		}
5207 	}, {
5208 		/* Same as ofb(aes) except the key is stored in
5209 		 * hardware secure memory which we reference by index
5210 		 */
5211 		.alg = "ofb(paes)",
5212 		.test = alg_test_null,
5213 		.fips_allowed = 1,
5214 	}, {
5215 		.alg = "ofb(sm4)",
5216 		.test = alg_test_skcipher,
5217 		.suite = {
5218 			.cipher = __VECS(sm4_ofb_tv_template)
5219 		}
5220 	}, {
5221 		.alg = "pcbc(fcrypt)",
5222 		.test = alg_test_skcipher,
5223 		.suite = {
5224 			.cipher = __VECS(fcrypt_pcbc_tv_template)
5225 		}
5226 	}, {
5227 		.alg = "pkcs1pad(rsa,sha224)",
5228 		.test = alg_test_null,
5229 		.fips_allowed = 1,
5230 	}, {
5231 		.alg = "pkcs1pad(rsa,sha256)",
5232 		.test = alg_test_akcipher,
5233 		.fips_allowed = 1,
5234 		.suite = {
5235 			.akcipher = __VECS(pkcs1pad_rsa_tv_template)
5236 		}
5237 	}, {
5238 		.alg = "pkcs1pad(rsa,sha384)",
5239 		.test = alg_test_null,
5240 		.fips_allowed = 1,
5241 	}, {
5242 		.alg = "pkcs1pad(rsa,sha512)",
5243 		.test = alg_test_null,
5244 		.fips_allowed = 1,
5245 	}, {
5246 		.alg = "poly1305",
5247 		.test = alg_test_hash,
5248 		.suite = {
5249 			.hash = __VECS(poly1305_tv_template)
5250 		}
5251 	}, {
5252 		.alg = "rfc3686(ctr(aes))",
5253 		.test = alg_test_skcipher,
5254 		.fips_allowed = 1,
5255 		.suite = {
5256 			.cipher = __VECS(aes_ctr_rfc3686_tv_template)
5257 		}
5258 	}, {
5259 		.alg = "rfc3686(ctr(sm4))",
5260 		.test = alg_test_skcipher,
5261 		.suite = {
5262 			.cipher = __VECS(sm4_ctr_rfc3686_tv_template)
5263 		}
5264 	}, {
5265 		.alg = "rfc4106(gcm(aes))",
5266 		.generic_driver = "rfc4106(gcm_base(ctr(aes-generic),ghash-generic))",
5267 		.test = alg_test_aead,
5268 		.fips_allowed = 1,
5269 		.suite = {
5270 			.aead = {
5271 				____VECS(aes_gcm_rfc4106_tv_template),
5272 				.einval_allowed = 1,
5273 				.aad_iv = 1,
5274 			}
5275 		}
5276 	}, {
5277 		.alg = "rfc4309(ccm(aes))",
5278 		.generic_driver = "rfc4309(ccm_base(ctr(aes-generic),cbcmac(aes-generic)))",
5279 		.test = alg_test_aead,
5280 		.fips_allowed = 1,
5281 		.suite = {
5282 			.aead = {
5283 				____VECS(aes_ccm_rfc4309_tv_template),
5284 				.einval_allowed = 1,
5285 				.aad_iv = 1,
5286 			}
5287 		}
5288 	}, {
5289 		.alg = "rfc4543(gcm(aes))",
5290 		.generic_driver = "rfc4543(gcm_base(ctr(aes-generic),ghash-generic))",
5291 		.test = alg_test_aead,
5292 		.suite = {
5293 			.aead = {
5294 				____VECS(aes_gcm_rfc4543_tv_template),
5295 				.einval_allowed = 1,
5296 				.aad_iv = 1,
5297 			}
5298 		}
5299 	}, {
5300 		.alg = "rfc7539(chacha20,poly1305)",
5301 		.test = alg_test_aead,
5302 		.suite = {
5303 			.aead = __VECS(rfc7539_tv_template)
5304 		}
5305 	}, {
5306 		.alg = "rfc7539esp(chacha20,poly1305)",
5307 		.test = alg_test_aead,
5308 		.suite = {
5309 			.aead = {
5310 				____VECS(rfc7539esp_tv_template),
5311 				.einval_allowed = 1,
5312 				.aad_iv = 1,
5313 			}
5314 		}
5315 	}, {
5316 		.alg = "rmd160",
5317 		.test = alg_test_hash,
5318 		.suite = {
5319 			.hash = __VECS(rmd160_tv_template)
5320 		}
5321 	}, {
5322 		.alg = "rsa",
5323 		.test = alg_test_akcipher,
5324 		.fips_allowed = 1,
5325 		.suite = {
5326 			.akcipher = __VECS(rsa_tv_template)
5327 		}
5328 	}, {
5329 		.alg = "sha1",
5330 		.test = alg_test_hash,
5331 		.fips_allowed = 1,
5332 		.suite = {
5333 			.hash = __VECS(sha1_tv_template)
5334 		}
5335 	}, {
5336 		.alg = "sha224",
5337 		.test = alg_test_hash,
5338 		.fips_allowed = 1,
5339 		.suite = {
5340 			.hash = __VECS(sha224_tv_template)
5341 		}
5342 	}, {
5343 		.alg = "sha256",
5344 		.test = alg_test_hash,
5345 		.fips_allowed = 1,
5346 		.suite = {
5347 			.hash = __VECS(sha256_tv_template)
5348 		}
5349 	}, {
5350 		.alg = "sha3-224",
5351 		.test = alg_test_hash,
5352 		.fips_allowed = 1,
5353 		.suite = {
5354 			.hash = __VECS(sha3_224_tv_template)
5355 		}
5356 	}, {
5357 		.alg = "sha3-256",
5358 		.test = alg_test_hash,
5359 		.fips_allowed = 1,
5360 		.suite = {
5361 			.hash = __VECS(sha3_256_tv_template)
5362 		}
5363 	}, {
5364 		.alg = "sha3-384",
5365 		.test = alg_test_hash,
5366 		.fips_allowed = 1,
5367 		.suite = {
5368 			.hash = __VECS(sha3_384_tv_template)
5369 		}
5370 	}, {
5371 		.alg = "sha3-512",
5372 		.test = alg_test_hash,
5373 		.fips_allowed = 1,
5374 		.suite = {
5375 			.hash = __VECS(sha3_512_tv_template)
5376 		}
5377 	}, {
5378 		.alg = "sha384",
5379 		.test = alg_test_hash,
5380 		.fips_allowed = 1,
5381 		.suite = {
5382 			.hash = __VECS(sha384_tv_template)
5383 		}
5384 	}, {
5385 		.alg = "sha512",
5386 		.test = alg_test_hash,
5387 		.fips_allowed = 1,
5388 		.suite = {
5389 			.hash = __VECS(sha512_tv_template)
5390 		}
5391 	}, {
5392 		.alg = "sm2",
5393 		.test = alg_test_akcipher,
5394 		.suite = {
5395 			.akcipher = __VECS(sm2_tv_template)
5396 		}
5397 	}, {
5398 		.alg = "sm3",
5399 		.test = alg_test_hash,
5400 		.suite = {
5401 			.hash = __VECS(sm3_tv_template)
5402 		}
5403 	}, {
5404 		.alg = "streebog256",
5405 		.test = alg_test_hash,
5406 		.suite = {
5407 			.hash = __VECS(streebog256_tv_template)
5408 		}
5409 	}, {
5410 		.alg = "streebog512",
5411 		.test = alg_test_hash,
5412 		.suite = {
5413 			.hash = __VECS(streebog512_tv_template)
5414 		}
5415 	}, {
5416 		.alg = "vmac64(aes)",
5417 		.test = alg_test_hash,
5418 		.suite = {
5419 			.hash = __VECS(vmac64_aes_tv_template)
5420 		}
5421 	}, {
5422 		.alg = "wp256",
5423 		.test = alg_test_hash,
5424 		.suite = {
5425 			.hash = __VECS(wp256_tv_template)
5426 		}
5427 	}, {
5428 		.alg = "wp384",
5429 		.test = alg_test_hash,
5430 		.suite = {
5431 			.hash = __VECS(wp384_tv_template)
5432 		}
5433 	}, {
5434 		.alg = "wp512",
5435 		.test = alg_test_hash,
5436 		.suite = {
5437 			.hash = __VECS(wp512_tv_template)
5438 		}
5439 	}, {
5440 		.alg = "xcbc(aes)",
5441 		.test = alg_test_hash,
5442 		.suite = {
5443 			.hash = __VECS(aes_xcbc128_tv_template)
5444 		}
5445 	}, {
5446 		.alg = "xchacha12",
5447 		.test = alg_test_skcipher,
5448 		.suite = {
5449 			.cipher = __VECS(xchacha12_tv_template)
5450 		},
5451 	}, {
5452 		.alg = "xchacha20",
5453 		.test = alg_test_skcipher,
5454 		.suite = {
5455 			.cipher = __VECS(xchacha20_tv_template)
5456 		},
5457 	}, {
5458 		.alg = "xts(aes)",
5459 		.generic_driver = "xts(ecb(aes-generic))",
5460 		.test = alg_test_skcipher,
5461 		.fips_allowed = 1,
5462 		.suite = {
5463 			.cipher = __VECS(aes_xts_tv_template)
5464 		}
5465 	}, {
5466 		.alg = "xts(camellia)",
5467 		.generic_driver = "xts(ecb(camellia-generic))",
5468 		.test = alg_test_skcipher,
5469 		.suite = {
5470 			.cipher = __VECS(camellia_xts_tv_template)
5471 		}
5472 	}, {
5473 		.alg = "xts(cast6)",
5474 		.generic_driver = "xts(ecb(cast6-generic))",
5475 		.test = alg_test_skcipher,
5476 		.suite = {
5477 			.cipher = __VECS(cast6_xts_tv_template)
5478 		}
5479 	}, {
5480 		/* Same as xts(aes) except the key is stored in
5481 		 * hardware secure memory which we reference by index
5482 		 */
5483 		.alg = "xts(paes)",
5484 		.test = alg_test_null,
5485 		.fips_allowed = 1,
5486 	}, {
5487 		.alg = "xts(serpent)",
5488 		.generic_driver = "xts(ecb(serpent-generic))",
5489 		.test = alg_test_skcipher,
5490 		.suite = {
5491 			.cipher = __VECS(serpent_xts_tv_template)
5492 		}
5493 	}, {
5494 		.alg = "xts(twofish)",
5495 		.generic_driver = "xts(ecb(twofish-generic))",
5496 		.test = alg_test_skcipher,
5497 		.suite = {
5498 			.cipher = __VECS(tf_xts_tv_template)
5499 		}
5500 	}, {
5501 #if IS_ENABLED(CONFIG_CRYPTO_PAES_S390)
5502 		.alg = "xts-paes-s390",
5503 		.fips_allowed = 1,
5504 		.test = alg_test_skcipher,
5505 		.suite = {
5506 			.cipher = __VECS(aes_xts_tv_template)
5507 		}
5508 	}, {
5509 #endif
5510 		.alg = "xts4096(paes)",
5511 		.test = alg_test_null,
5512 		.fips_allowed = 1,
5513 	}, {
5514 		.alg = "xts512(paes)",
5515 		.test = alg_test_null,
5516 		.fips_allowed = 1,
5517 	}, {
5518 		.alg = "xxhash64",
5519 		.test = alg_test_hash,
5520 		.fips_allowed = 1,
5521 		.suite = {
5522 			.hash = __VECS(xxhash64_tv_template)
5523 		}
5524 	}, {
5525 		.alg = "zlib-deflate",
5526 		.test = alg_test_comp,
5527 		.fips_allowed = 1,
5528 		.suite = {
5529 			.comp = {
5530 				.comp = __VECS(zlib_deflate_comp_tv_template),
5531 				.decomp = __VECS(zlib_deflate_decomp_tv_template)
5532 			}
5533 		}
5534 	}, {
5535 		.alg = "zstd",
5536 		.test = alg_test_comp,
5537 		.fips_allowed = 1,
5538 		.suite = {
5539 			.comp = {
5540 				.comp = __VECS(zstd_comp_tv_template),
5541 				.decomp = __VECS(zstd_decomp_tv_template)
5542 			}
5543 		}
5544 	}
5545 };
5546 
5547 static void alg_check_test_descs_order(void)
5548 {
5549 	int i;
5550 
5551 	for (i = 1; i < ARRAY_SIZE(alg_test_descs); i++) {
5552 		int diff = strcmp(alg_test_descs[i - 1].alg,
5553 				  alg_test_descs[i].alg);
5554 
5555 		if (WARN_ON(diff > 0)) {
5556 			pr_warn("testmgr: alg_test_descs entries in wrong order: '%s' before '%s'\n",
5557 				alg_test_descs[i - 1].alg,
5558 				alg_test_descs[i].alg);
5559 		}
5560 
5561 		if (WARN_ON(diff == 0)) {
5562 			pr_warn("testmgr: duplicate alg_test_descs entry: '%s'\n",
5563 				alg_test_descs[i].alg);
5564 		}
5565 	}
5566 }
5567 
5568 static void alg_check_testvec_configs(void)
5569 {
5570 	int i;
5571 
5572 	for (i = 0; i < ARRAY_SIZE(default_cipher_testvec_configs); i++)
5573 		WARN_ON(!valid_testvec_config(
5574 				&default_cipher_testvec_configs[i]));
5575 
5576 	for (i = 0; i < ARRAY_SIZE(default_hash_testvec_configs); i++)
5577 		WARN_ON(!valid_testvec_config(
5578 				&default_hash_testvec_configs[i]));
5579 }
5580 
5581 static void testmgr_onetime_init(void)
5582 {
5583 	alg_check_test_descs_order();
5584 	alg_check_testvec_configs();
5585 
5586 #ifdef CONFIG_CRYPTO_MANAGER_EXTRA_TESTS
5587 	pr_warn("alg: extra crypto tests enabled.  This is intended for developer use only.\n");
5588 #endif
5589 }
5590 
5591 static int alg_find_test(const char *alg)
5592 {
5593 	int start = 0;
5594 	int end = ARRAY_SIZE(alg_test_descs);
5595 
5596 	while (start < end) {
5597 		int i = (start + end) / 2;
5598 		int diff = strcmp(alg_test_descs[i].alg, alg);
5599 
5600 		if (diff > 0) {
5601 			end = i;
5602 			continue;
5603 		}
5604 
5605 		if (diff < 0) {
5606 			start = i + 1;
5607 			continue;
5608 		}
5609 
5610 		return i;
5611 	}
5612 
5613 	return -1;
5614 }
5615 
5616 int alg_test(const char *driver, const char *alg, u32 type, u32 mask)
5617 {
5618 	int i;
5619 	int j;
5620 	int rc;
5621 
5622 	if (!fips_enabled && notests) {
5623 		printk_once(KERN_INFO "alg: self-tests disabled\n");
5624 		return 0;
5625 	}
5626 
5627 	DO_ONCE(testmgr_onetime_init);
5628 
5629 	if ((type & CRYPTO_ALG_TYPE_MASK) == CRYPTO_ALG_TYPE_CIPHER) {
5630 		char nalg[CRYPTO_MAX_ALG_NAME];
5631 
5632 		if (snprintf(nalg, sizeof(nalg), "ecb(%s)", alg) >=
5633 		    sizeof(nalg))
5634 			return -ENAMETOOLONG;
5635 
5636 		i = alg_find_test(nalg);
5637 		if (i < 0)
5638 			goto notest;
5639 
5640 		if (fips_enabled && !alg_test_descs[i].fips_allowed)
5641 			goto non_fips_alg;
5642 
5643 		rc = alg_test_cipher(alg_test_descs + i, driver, type, mask);
5644 		goto test_done;
5645 	}
5646 
5647 	i = alg_find_test(alg);
5648 	j = alg_find_test(driver);
5649 	if (i < 0 && j < 0)
5650 		goto notest;
5651 
5652 	if (fips_enabled && ((i >= 0 && !alg_test_descs[i].fips_allowed) ||
5653 			     (j >= 0 && !alg_test_descs[j].fips_allowed)))
5654 		goto non_fips_alg;
5655 
5656 	rc = 0;
5657 	if (i >= 0)
5658 		rc |= alg_test_descs[i].test(alg_test_descs + i, driver,
5659 					     type, mask);
5660 	if (j >= 0 && j != i)
5661 		rc |= alg_test_descs[j].test(alg_test_descs + j, driver,
5662 					     type, mask);
5663 
5664 test_done:
5665 	if (rc) {
5666 		if (fips_enabled || panic_on_fail) {
5667 			fips_fail_notify();
5668 			panic("alg: self-tests for %s (%s) failed in %s mode!\n",
5669 			      driver, alg,
5670 			      fips_enabled ? "fips" : "panic_on_fail");
5671 		}
5672 		WARN(1, "alg: self-tests for %s (%s) failed (rc=%d)",
5673 		     driver, alg, rc);
5674 	} else {
5675 		if (fips_enabled)
5676 			pr_info("alg: self-tests for %s (%s) passed\n",
5677 				driver, alg);
5678 	}
5679 
5680 	return rc;
5681 
5682 notest:
5683 	printk(KERN_INFO "alg: No test for %s (%s)\n", alg, driver);
5684 	return 0;
5685 non_fips_alg:
5686 	return -EINVAL;
5687 }
5688 
5689 #endif /* CONFIG_CRYPTO_MANAGER_DISABLE_TESTS */
5690 
5691 EXPORT_SYMBOL_GPL(alg_test);
5692