lib/crypto/tests/aead-test-template.h

/* SPDX-License-Identifier: GPL-2.0-or-later */
/*
 * Shared KUnit test cases for AEAD algorithms, including a benchmark
 *
 * Copyright 2026 Google LLC
 */

/*
 * This file implements KUnit test cases shared by the different KUnit test
 * suites for Authenticated Encryption with Associated Data (AEAD) algorithms.
 *
 * Test suites including this file must #define the following:
 *
 * Data structs:
 * - AEAD_KEY: name of key struct
 * - AEAD_CTX: name of context for incremental computation
 *
 * Constants:
 * - AEAD_VALID_KEY_LENS: array of all valid key lengths in bytes
 * - AEAD_VALID_NONCE_LENS: array of all valid nonce lengths in bytes
 * - AEAD_VALID_TAG_LENS: array of all valid authtag lengths in bytes
 * - AEAD_MAX_KEY_LEN: max key length in bytes (assumed to fit on stack)
 * - AEAD_MAX_NONCE_LEN: max nonce length in bytes (assumed to fit on stack)
 * - AEAD_MAX_TAG_LEN: max authtag length in bytes (assumed to fit on stack)
 * - AEAD_MONTE_CARLO_CHECKSUM: checksum of a deterministically generated series
 *   of (ciphertext, authtag) pairs (see test_aead_monte_carlo())
 *
 * Functions:
 * - AEAD_PREPAREKEY: key preparation
 * - AEAD_ENCRYPT and AEAD_DECRYPT: one-shot encryption and decryption
 * - AEAD_INIT, AEAD_AUTH_UPDATE, AEAD_ENCRYPT_UPDATE, AEAD_ENCRYPT_FINAL,
 *   AEAD_DECRYPT_UPDATE, AEAD_DECRYPT_FINAL: functions for incremental
 *   encryption and decryption
 *
 * Function prototypes and their behavior must match the AES-CCM API.
 */

#include <crypto/blake2s.h>
#include <kunit/run-in-irq-context.h>
#include <kunit/test.h>
#include <linux/ktime.h>
#include <linux/preempt.h>
#include "test-utils.h"

/*
 * Allocate a KUnit-managed struct AEAD_KEY and prepare it with a random key,
 * using a random key length and random authentication tag length.
 */
static struct AEAD_KEY *aead_alloc_random_key(struct kunit *test,
					      size_t *tag_len_ret)
{
	size_t key_len =
		AEAD_VALID_KEY_LENS[rand32() % ARRAY_SIZE(AEAD_VALID_KEY_LENS)];
	size_t tag_len =
		AEAD_VALID_TAG_LENS[rand32() % ARRAY_SIZE(AEAD_VALID_TAG_LENS)];
	u8 raw_key[AEAD_MAX_KEY_LEN];
	struct AEAD_KEY *key = alloc_buf(test, sizeof(*key));
	int err;

	rand_bytes(raw_key, key_len);
	err = AEAD_PREPAREKEY(key, raw_key, key_len, tag_len);
	KUNIT_ASSERT_EQ(test, 0, err);
	*tag_len_ret = tag_len;
	return key;
}

/*
 * Allocate a KUnit-managed slab buffer of length @len bytes and initialize it
 * with random data.
 */
static u8 *aead_alloc_random_data(struct kunit *test, size_t len)
{
	u8 *buf = alloc_buf(test, len);

	rand_bytes(buf, len);
	return buf;
}

/*
 * Allocate a KUnit-managed guarded buffer of length @len bytes and initialize
 * it with random data.
 */
static u8 *aead_alloc_random_data_guarded(struct kunit *test, size_t len)
{
	u8 *buf = alloc_guarded_buf(test, len);

	rand_bytes(buf, len);
	return buf;
}

/* Process the given associated data using a random incremental strategy. */
static size_t aead_auth_incrementally(struct AEAD_CTX *ctx, const u8 *ad,
				      size_t ad_len)
{
	size_t num_parts = 0;
	size_t pos = 0;

	while (rand_bool()) {
		size_t part_len = rand_length(ad_len - pos);

		AEAD_AUTH_UPDATE(ctx, &ad[pos], part_len);
		pos += part_len;
		num_parts++;
	}
	if (pos < ad_len || rand_bool()) {
		AEAD_AUTH_UPDATE(ctx, &ad[pos], ad_len - pos);
		num_parts++;
	}
	return num_parts;
}

/* Process the given en/decrypted data using a random incremental strategy. */
static size_t aead_crypt_incrementally(struct AEAD_CTX *ctx, u8 *dst,
				       const u8 *src, size_t data_len, bool enc)
{
	size_t num_parts = 0;
	size_t pos = 0;

	while (rand_bool()) {
		size_t part_len = rand_length(data_len - pos);

		if (enc)
			AEAD_ENCRYPT_UPDATE(ctx, &dst[pos], &src[pos],
					    part_len);
		else
			AEAD_DECRYPT_UPDATE(ctx, &dst[pos], &src[pos],
					    part_len);
		pos += part_len;
		num_parts++;
	}
	if (pos < data_len || rand_bool()) {
		if (enc)
			AEAD_ENCRYPT_UPDATE(ctx, &dst[pos], &src[pos],
					    data_len - pos);
		else
			AEAD_DECRYPT_UPDATE(ctx, &dst[pos], &src[pos],
					    data_len - pos);
		num_parts++;
	}
	return num_parts;
}

struct aead_incremental_info {
	size_t num_data_parts;
	size_t num_ad_parts;
};

static const char *aead_incr_info_str(struct kunit *test,
				      const struct aead_incremental_info *info)
{
	const size_t max_str_len = 64;
	char *str = alloc_buf(test, max_str_len);

	snprintf(str, max_str_len, "num_data_parts=%zu num_ad_parts=%zu",
		 info->num_data_parts, info->num_ad_parts);
	return str;
}

/*
 * Encrypt data using a random incremental strategy.
 * Return information about the incremental strategy used.
 */
static struct aead_incremental_info
aead_encrypt_incrementally(struct kunit *test, struct AEAD_CTX *ctx, u8 *dst,
			   const u8 *src, size_t data_len, u8 *tag,
			   const u8 *ad, size_t ad_len, const u8 *nonce,
			   size_t nonce_len, const struct AEAD_KEY *key)
{
	struct aead_incremental_info info;
	int err;

	err = AEAD_INIT(ctx, data_len, ad_len, nonce, nonce_len, key);
	KUNIT_ASSERT_EQ(test, 0, err);
	info.num_ad_parts = aead_auth_incrementally(ctx, ad, ad_len);
	info.num_data_parts = aead_crypt_incrementally(ctx, dst, src, data_len,
						       /* enc= */ true);
	AEAD_ENCRYPT_FINAL(ctx, tag);
	KUNIT_ASSERT_TRUE_MSG(test, mem_is_zero(ctx, sizeof(*ctx)),
			      "encrypt_final didn't zeroize context");
	return info;
}

/*
 * Decrypt authentic data using a random incremental strategy.
 * Return information about the incremental strategy used.
 */
static struct aead_incremental_info
aead_decrypt_incrementally(struct kunit *test, struct AEAD_CTX *ctx, u8 *dst,
			   const u8 *src, size_t data_len, const u8 *tag,
			   const u8 *ad, size_t ad_len, const u8 *nonce,
			   size_t nonce_len, const struct AEAD_KEY *key)
{
	struct aead_incremental_info info;
	int err;

	err = AEAD_INIT(ctx, data_len, ad_len, nonce, nonce_len, key);
	KUNIT_ASSERT_EQ(test, 0, err);
	info.num_ad_parts = aead_auth_incrementally(ctx, ad, ad_len);
	info.num_data_parts = aead_crypt_incrementally(ctx, dst, src, data_len,
						       /* enc= */ false);
	err = AEAD_DECRYPT_FINAL(ctx, tag);
	KUNIT_ASSERT_EQ(test, 0, err);
	KUNIT_ASSERT_TRUE_MSG(test, mem_is_zero(ctx, sizeof(*ctx)),
			      "decrypt_final didn't zeroize context");
	return info;
}

/* Return true if key_len is declared to be a valid key length. */
static bool aead_is_key_len_expected_valid(size_t key_len)
{
	for (size_t i = 0; i < ARRAY_SIZE(AEAD_VALID_KEY_LENS); i++) {
		if (AEAD_VALID_KEY_LENS[i] == key_len)
			return true;
	}
	return false;
}

/* Return true if nonce_len is declared to be a valid nonce length. */
static bool aead_is_nonce_len_expected_valid(size_t nonce_len)
{
	for (size_t i = 0; i < ARRAY_SIZE(AEAD_VALID_NONCE_LENS); i++) {
		if (AEAD_VALID_NONCE_LENS[i] == nonce_len)
			return true;
	}
	return false;
}

/* Return true if tag_len is declared to be a valid tag length. */
static bool aead_is_tag_len_expected_valid(size_t tag_len)
{
	for (size_t i = 0; i < ARRAY_SIZE(AEAD_VALID_TAG_LENS); i++) {
		if (AEAD_VALID_TAG_LENS[i] == tag_len)
			return true;
	}
	return false;
}

struct aead_basic_validation_test_ctx {
	struct AEAD_KEY key;
	struct AEAD_CTX ctx;
	u8 *raw_key_buf_end;
	u8 *nonce_buf_end;
	u8 *tag_buf_end;
	u8 pt[64]; /* plaintext */
	u8 ct[64]; /* ciphertext */
	u8 decrypted[64];
	u8 ad[16]; /* associated data */
	u8 *unused_buf;
	size_t data_len;
	size_t ad_len;
};

static struct aead_basic_validation_test_ctx *
aead_alloc_basic_validation_test_ctx(struct kunit *test)
{
	struct aead_basic_validation_test_ctx *ctx =
		alloc_buf(test, sizeof(*ctx));

	memset(ctx, 0, sizeof(*ctx));
	ctx->raw_key_buf_end =
		aead_alloc_random_data_guarded(test, AEAD_MAX_KEY_LEN) +
		AEAD_MAX_KEY_LEN;
	ctx->nonce_buf_end =
		aead_alloc_random_data_guarded(test, AEAD_MAX_NONCE_LEN) +
		AEAD_MAX_NONCE_LEN;
	ctx->tag_buf_end =
		aead_alloc_random_data_guarded(test, AEAD_MAX_TAG_LEN) +
		AEAD_MAX_TAG_LEN;

	/*
	 * A pointer to this buffer is passed when passing a length that is
	 * expected to be invalid.  It should never actually be accessed.
	 */
	ctx->unused_buf =
		alloc_buf(test, max3(AEAD_MAX_KEY_LEN, AEAD_MAX_NONCE_LEN,
				     AEAD_MAX_TAG_LEN));

	ctx->data_len = sizeof(ctx->pt);
	ctx->ad_len = sizeof(ctx->ad);
	return ctx;
}

/*
 * Given an expected-valid key_len, nonce_len, and tag_len, verify round-trip
 * encryption and decryption with them.  Use guarded buffers for each of the raw
 * key, nonce, and tag to detect any buffer overruns in them.  Also, verify that
 * every byte of the tag is actually checked.
 */
static void aead_do_basic_checks(struct kunit *test,
				 struct aead_basic_validation_test_ctx *ctx,
				 size_t key_len, size_t nonce_len,
				 size_t tag_len)
{
	/* Set up exact-size guarded buffers for (raw_key, nonce, tag). */
	const u8 *raw_key = ctx->raw_key_buf_end - key_len;
	const u8 *nonce = ctx->nonce_buf_end - nonce_len;
	u8 *tag = ctx->tag_buf_end - tag_len;
	int err;

	/* Key preparation should succeed. */
	err = AEAD_PREPAREKEY(&ctx->key, raw_key, key_len, tag_len);
	KUNIT_ASSERT_EQ_MSG(test, 0, err,
			    "key_len=%zu, tag_len=%zu wasn't accepted", key_len,
			    tag_len);

	/* Encryption should succeed. */
	err = AEAD_ENCRYPT(ctx->ct, ctx->pt, ctx->data_len, tag, ctx->ad,
			   ctx->ad_len, nonce, nonce_len, &ctx->key);
	KUNIT_ASSERT_EQ_MSG(
		test, 0, err,
		"Encryption failed with key_len=%zu, nonce_len=%zu, tag_len=%zu",
		key_len, nonce_len, tag_len);

	/* Decryption should succeed and give the original data. */
	err = AEAD_DECRYPT(ctx->decrypted, ctx->ct, ctx->data_len, tag, ctx->ad,
			   ctx->ad_len, nonce, nonce_len, &ctx->key);
	KUNIT_ASSERT_EQ_MSG(
		test, 0, err,
		"Decryption failed with key_len=%zu, nonce_len=%zu, tag_len=%zu",
		key_len, nonce_len, tag_len);
	KUNIT_ASSERT_MEMEQ_MSG(
		test, ctx->pt, ctx->decrypted, ctx->data_len,
		"Decryption gave wrong output with key_len=%zu, nonce_len=%zu, tag_len=%zu",
		key_len, nonce_len, tag_len);

	/*
	 * Every byte of the tag should actually be checked.
	 * And on authentication failure, the dst buffer should be cleared.
	 */
	for (size_t i = 0; i < tag_len; i++) {
		memset(ctx->decrypted, 0xff, ctx->data_len);
		tag[i] ^= 1;
		err = AEAD_DECRYPT(ctx->decrypted, ctx->ct, ctx->data_len, tag,
				   ctx->ad, ctx->ad_len, nonce, nonce_len,
				   &ctx->key);
		KUNIT_ASSERT_EQ_MSG(
			test, -EBADMSG, err,
			"Decryption with bad auth tag with key_len=%zu, nonce_len=%zu, tag_len=%zu didn't fail with -EBADMSG",
			key_len, nonce_len, tag_len);
		KUNIT_ASSERT_TRUE_MSG(
			test, mem_is_zero(ctx->decrypted, ctx->data_len),
			"dst wasn't cleared on authentication failure");
		tag[i] ^= 1;
	}
}

/* Verify that the given expected-invalid key_len is actually rejected. */
static void
aead_verify_invalid_key_len(struct kunit *test,
			    struct aead_basic_validation_test_ctx *ctx,
			    size_t key_len)
{
	int err;

	/*
	 * The preparekey function should reject the key_len.  It should do so
	 * before writing to the key struct.
	 */
	memset(&ctx->key, 0, sizeof(ctx->key));
	err = AEAD_PREPAREKEY(&ctx->key, ctx->unused_buf, key_len,
			      AEAD_MAX_TAG_LEN);
	KUNIT_ASSERT_EQ_MSG(test, -EINVAL, err,
			    "key_len=%zu wasn't rejected with -EINVAL",
			    key_len);
	KUNIT_ASSERT_TRUE_MSG(
		test, mem_is_zero(&ctx->key, sizeof(ctx->key)),
		"Key struct was written to before length validation");
}

/*
 * Test that every valid key length is accepted and basic checks pass with it,
 * and test that invalid key lengths are rejected.
 */
static void test_aead_all_key_lens(struct kunit *test)
{
	struct aead_basic_validation_test_ctx *ctx =
		aead_alloc_basic_validation_test_ctx(test);

	for (size_t key_len = 0; key_len <= AEAD_MAX_KEY_LEN; key_len++) {
		if (aead_is_key_len_expected_valid(key_len))
			aead_do_basic_checks(test, ctx, key_len,
					     AEAD_MAX_NONCE_LEN,
					     AEAD_MAX_TAG_LEN);
		else
			aead_verify_invalid_key_len(test, ctx, key_len);
	}
	aead_verify_invalid_key_len(test, ctx, AEAD_MAX_KEY_LEN + 1);
	aead_verify_invalid_key_len(test, ctx, AEAD_MAX_KEY_LEN * 2);
	aead_verify_invalid_key_len(test, ctx, U32_MAX);
	aead_verify_invalid_key_len(test, ctx, SIZE_MAX);
}

/* Verify that the given expected-invalid nonce_len is actually rejected. */
static void
aead_verify_invalid_nonce_len(struct kunit *test,
			      struct aead_basic_validation_test_ctx *ctx,
			      size_t nonce_len)
{
	static const u8 raw_key[AEAD_MAX_KEY_LEN];
	int err;

	/* Key preparation should succeed, as nonce_len isn't given yet. */
	err = AEAD_PREPAREKEY(&ctx->key, raw_key, sizeof(raw_key),
			      AEAD_MAX_TAG_LEN);
	KUNIT_ASSERT_EQ(test, 0, err);

	/* The init function should reject the nonce_len. */
	memset(&ctx->ctx, 0, sizeof(ctx->ctx));
	err = AEAD_INIT(&ctx->ctx, ctx->data_len, ctx->ad_len, ctx->unused_buf,
			nonce_len, &ctx->key);
	KUNIT_ASSERT_EQ_MSG(test, -EINVAL, err,
			    "nonce_len=%zu wasn't rejected with -EINVAL (init)",
			    nonce_len);
	KUNIT_ASSERT_TRUE_MSG(
		test, mem_is_zero(&ctx->ctx, sizeof(ctx->ctx)),
		"Context struct was written to before length validation");

	/* The encrypt function should reject the nonce_len. */
	err = AEAD_ENCRYPT(ctx->ct, ctx->pt, ctx->data_len, ctx->unused_buf,
			   ctx->ad, ctx->ad_len, ctx->unused_buf, nonce_len,
			   &ctx->key);
	KUNIT_ASSERT_EQ_MSG(
		test, -EINVAL, err,
		"nonce_len=%zu wasn't rejected with -EINVAL (encrypt)",
		nonce_len);

	/* The decrypt function should reject the nonce_len. */
	err = AEAD_DECRYPT(ctx->pt, ctx->ct, ctx->data_len, ctx->unused_buf,
			   ctx->ad, ctx->ad_len, ctx->unused_buf, nonce_len,
			   &ctx->key);
	KUNIT_ASSERT_EQ_MSG(
		test, -EINVAL, err,
		"nonce_len=%zu wasn't rejected with -EINVAL (decrypt)",
		nonce_len);
}

/*
 * Test that every valid nonce length is accepted and basic checks pass with it,
 * and test that invalid nonce lengths are rejected.
 */
static void test_aead_all_nonce_lens(struct kunit *test)
{
	struct aead_basic_validation_test_ctx *ctx =
		aead_alloc_basic_validation_test_ctx(test);

	for (size_t nonce_len = 0; nonce_len <= AEAD_MAX_NONCE_LEN;
	     nonce_len++) {
		if (aead_is_nonce_len_expected_valid(nonce_len))
			aead_do_basic_checks(test, ctx, AEAD_MAX_KEY_LEN,
					     nonce_len, AEAD_MAX_TAG_LEN);
		else
			aead_verify_invalid_nonce_len(test, ctx, nonce_len);
	}
	aead_verify_invalid_nonce_len(test, ctx, AEAD_MAX_NONCE_LEN + 1);
	aead_verify_invalid_nonce_len(test, ctx, AEAD_MAX_NONCE_LEN * 2);
	aead_verify_invalid_nonce_len(test, ctx, U32_MAX);
	aead_verify_invalid_nonce_len(test, ctx, SIZE_MAX);
}

/* Verify that the given expected-invalid tag_len is actually rejected. */
static void
aead_verify_invalid_tag_len(struct kunit *test,
			    struct aead_basic_validation_test_ctx *ctx,
			    size_t tag_len)
{
	static const u8 raw_key[AEAD_MAX_KEY_LEN];
	int err;

	/*
	 * The preparekey function should reject the tag_len.  It should do so
	 * before writing to the key struct.
	 */
	memset(&ctx->key, 0, sizeof(ctx->key));
	err = AEAD_PREPAREKEY(&ctx->key, raw_key, sizeof(raw_key), tag_len);
	KUNIT_ASSERT_EQ_MSG(test, -EINVAL, err,
			    "tag_len=%zu wasn't rejected with -EINVAL",
			    tag_len);
	KUNIT_ASSERT_TRUE_MSG(
		test, mem_is_zero(&ctx->key, sizeof(ctx->key)),
		"Key struct was written to before length validation");
}

/*
 * Test that every valid authentication tag length is accepted and basic checks
 * pass with it, and test that invalid authentication tag lengths are rejected.
 */
static void test_aead_all_tag_lens(struct kunit *test)
{
	struct aead_basic_validation_test_ctx *ctx =
		aead_alloc_basic_validation_test_ctx(test);

	for (size_t tag_len = 0; tag_len <= AEAD_MAX_TAG_LEN; tag_len++) {
		if (aead_is_tag_len_expected_valid(tag_len))
			aead_do_basic_checks(test, ctx, AEAD_MAX_KEY_LEN,
					     AEAD_MAX_NONCE_LEN, tag_len);
		else
			aead_verify_invalid_tag_len(test, ctx, tag_len);
	}
	aead_verify_invalid_tag_len(test, ctx, AEAD_MAX_TAG_LEN + 1);
	aead_verify_invalid_tag_len(test, ctx, AEAD_MAX_TAG_LEN * 2);
	aead_verify_invalid_tag_len(test, ctx, U32_MAX);
	aead_verify_invalid_tag_len(test, ctx, SIZE_MAX);
}

/*
 * Test that one-shot encryption and decryption are consistent with each other
 * and with incremental encryption and decryption.
 */
static void test_aead_incremental_updates(struct kunit *test)
{
	const size_t max_data_len = 1024;
	const size_t max_ad_len = 512;
	const size_t nonce_len = AEAD_MAX_NONCE_LEN;
	size_t tag_len;
	struct AEAD_KEY *key = aead_alloc_random_key(test, &tag_len);
	struct AEAD_CTX *ctx = alloc_buf(test, sizeof(*ctx));
	u8 *pt = aead_alloc_random_data(test, max_data_len);
	u8 *ad = aead_alloc_random_data(test, max_ad_len);
	u8 *nonce = aead_alloc_random_data(test, nonce_len);
	u8 *ct = alloc_buf(test, max_data_len);
	u8 *ct2 = alloc_buf(test, max_data_len);
	u8 *decrypted = alloc_buf(test, max_data_len);
	u8 *tag = alloc_buf(test, tag_len);
	u8 *tag2 = alloc_buf(test, tag_len);
	int err;

	for (int i = 0; i < 500; i++) {
		/* Select the lengths to test. */
		const size_t data_len = rand_length(max_data_len);
		const size_t ad_len = rand_length(max_ad_len);
		struct aead_incremental_info incr_info;

		/* Try one-shot encryption and decryption. */
		err = AEAD_ENCRYPT(ct, pt, data_len, tag, ad, ad_len, nonce,
				   nonce_len, key);
		KUNIT_ASSERT_EQ(test, 0, err);
		err = AEAD_DECRYPT(decrypted, ct, data_len, tag, ad, ad_len,
				   nonce, nonce_len, key);
		KUNIT_ASSERT_EQ(test, 0, err);
		KUNIT_ASSERT_MEMEQ_MSG(
			test, pt, decrypted, data_len,
			"Decryption didn't invert encryption; data_len=%zu, ad_len=%zu",
			data_len, ad_len);

		/* Try incremental encryption and decryption. */
		incr_info = aead_encrypt_incrementally(test, ctx, ct2, pt,
						       data_len, tag2, ad,
						       ad_len, nonce, nonce_len,
						       key);
		KUNIT_ASSERT_MEMEQ_MSG(
			test, ct, ct2, data_len,
			"One-shot and incremental encryption gave different ciphertexts; data_len=%zu ad_len=%zu %s",
			data_len, ad_len, aead_incr_info_str(test, &incr_info));
		KUNIT_ASSERT_MEMEQ_MSG(
			test, tag, tag2, tag_len,
			"One-shot and incremental encryption gave different auth tags; data_len=%zu ad_len=%zu %s",
			data_len, ad_len, aead_incr_info_str(test, &incr_info));
		incr_info = aead_decrypt_incrementally(test, ctx, decrypted,
						       ct2, data_len, tag2, ad,
						       ad_len, nonce, nonce_len,
						       key);
		KUNIT_ASSERT_MEMEQ_MSG(
			test, pt, decrypted, data_len,
			"One-shot and incremental decryption gave different plaintexts; data_len=%zu ad_len=%zu %s",
			data_len, ad_len, aead_incr_info_str(test, &incr_info));
	}
}

/*
 * Test using guarded buffers for the plaintext, ciphertext, and associated
 * data.  This detects out-of-bounds accesses, even in assembly code.
 *
 * Note: other test cases cover overrun of raw_key, nonce, and tag.
 */
static void test_aead_data_buffer_overruns(struct kunit *test)
{
	const size_t max_data_len = 1024;
	const size_t max_ad_len = 512;
	const size_t nonce_len = AEAD_MAX_NONCE_LEN;
	size_t tag_len;
	struct AEAD_KEY *key = aead_alloc_random_key(test, &tag_len);
	const u8 *nonce = aead_alloc_random_data(test, nonce_len);
	const u8 *pt_end = aead_alloc_random_data_guarded(test, max_data_len) +
			   max_data_len;
	const u8 *ad_end =
		aead_alloc_random_data_guarded(test, max_ad_len) + max_ad_len;
	u8 *ct_end = alloc_guarded_buf(test, max_data_len) + max_data_len;
	u8 *decrypted_end =
		alloc_guarded_buf(test, max_data_len) + max_data_len;
	u8 *tag = alloc_buf(test, tag_len);

	for (int i = 0; i < 200; i++) {
		/* Select the lengths to test. */
		const size_t data_len = rand_length(max_data_len);
		const size_t ad_len = rand_length(max_ad_len);
		/* Set up exact-size guarded buffers. */
		const u8 *pt = pt_end - data_len;
		const u8 *ad = ad_end - ad_len;
		u8 *ct = ct_end - data_len;
		u8 *decrypted = decrypted_end - data_len;
		int err;

		/* Encrypt and decrypt. */
		err = AEAD_ENCRYPT(ct, pt, data_len, tag, ad, ad_len, nonce,
				   nonce_len, key);
		KUNIT_ASSERT_EQ(test, 0, err);
		err = AEAD_DECRYPT(decrypted, ct, data_len, tag, ad, ad_len,
				   nonce, nonce_len, key);
		KUNIT_ASSERT_EQ(test, 0, err);
		KUNIT_ASSERT_MEMEQ_MSG(
			test, pt, decrypted, data_len,
			"Decryption didn't invert encryption; data_len=%zu, ad_len=%zu",
			data_len, ad_len);
	}
}

/*
 * Test that encryption and decryption produce the same results regardless of
 * how the buffers are aligned in memory.
 */
static void test_aead_alignment_consistency(struct kunit *test)
{
	const size_t max_data_len = 4096;
	const size_t max_ad_len = 4096;
	const size_t max_offset = 128;
	const size_t nonce_len = AEAD_MAX_NONCE_LEN;
	const size_t key_len = AEAD_MAX_KEY_LEN;
	const size_t tag_len = AEAD_MAX_TAG_LEN;
	u8 *raw_key1_buf = alloc_buf(test, key_len + max_offset);
	u8 *raw_key2_buf = alloc_buf(test, key_len + max_offset);
	u8 *nonce1_buf = alloc_buf(test, nonce_len + max_offset);
	u8 *nonce2_buf = alloc_buf(test, nonce_len + max_offset);
	u8 *pt1_buf = alloc_buf(test, max_data_len);
	u8 *pt2_buf = alloc_buf(test, max_data_len);
	u8 *ct1_buf = alloc_buf(test, max_data_len);
	u8 *ct2_buf = alloc_buf(test, max_data_len);
	u8 *ad1_buf = alloc_buf(test, max_ad_len);
	u8 *ad2_buf = alloc_buf(test, max_ad_len);
	u8 *tag1_buf = alloc_buf(test, tag_len + max_offset);
	u8 *tag2_buf = alloc_buf(test, tag_len + max_offset);
	struct AEAD_KEY *key = alloc_buf(test, sizeof(*key));
	int err;

	for (int i = 0; i < 100; i++) {
		/* Generate lengths. */
		size_t data_len = rand_length(max_data_len);
		size_t ad_len = rand_length(max_ad_len);

		/* Generate two sets of alignments. */
		u8 *raw_key1 = raw_key1_buf + rand_offset(max_offset);
		u8 *raw_key2 = raw_key2_buf + rand_offset(max_offset);
		u8 *nonce1 = nonce1_buf + rand_offset(max_offset);
		u8 *nonce2 = nonce2_buf + rand_offset(max_offset);
		u8 *pt1 = pt1_buf + rand_offset(max_data_len - data_len);
		u8 *pt2 = pt2_buf + rand_offset(max_data_len - data_len);
		u8 *ct1 = ct1_buf + rand_offset(max_data_len - data_len);
		u8 *ct2 = ct2_buf + rand_offset(max_data_len - data_len);
		u8 *ad1 = ad1_buf + rand_offset(max_ad_len - ad_len);
		u8 *ad2 = ad2_buf + rand_offset(max_ad_len - ad_len);
		u8 *tag1 = tag1_buf + rand_offset(max_offset);
		u8 *tag2 = tag2_buf + rand_offset(max_offset);

		/*
		 * Generate inputs in the first set of buffers using the first
		 * set of alignments.
		 */
		rand_bytes(raw_key1, key_len);
		rand_bytes(nonce1, nonce_len);
		rand_bytes(pt1, data_len);
		rand_bytes(ad1, ad_len);

		/*
		 * Copy the inputs to the second set of buffers using the second
		 * set of alignments.
		 */
		memcpy(raw_key2, raw_key1, key_len);
		memcpy(nonce2, nonce1, nonce_len);
		memcpy(pt2, pt1, data_len);
		memcpy(ad2, ad1, ad_len);

		/* Verify encryption consistency. */

		err = AEAD_PREPAREKEY(key, raw_key1, key_len, tag_len);
		KUNIT_ASSERT_EQ(test, 0, err);
		err = AEAD_ENCRYPT(ct1, pt1, data_len, tag1, ad1, ad_len,
				   nonce1, nonce_len, key);
		KUNIT_ASSERT_EQ(test, 0, err);

		err = AEAD_PREPAREKEY(key, raw_key2, key_len, tag_len);
		KUNIT_ASSERT_EQ(test, 0, err);
		err = AEAD_ENCRYPT(ct2, pt2, data_len, tag2, ad2, ad_len,
				   nonce2, nonce_len, key);
		KUNIT_ASSERT_EQ(test, 0, err);

		KUNIT_ASSERT_MEMEQ(test, ct1, ct2, data_len);
		KUNIT_ASSERT_MEMEQ(test, tag1, tag2, tag_len);

		/* Verify decryption consistency. */

		err = AEAD_PREPAREKEY(key, raw_key1, key_len, tag_len);
		KUNIT_ASSERT_EQ(test, 0, err);
		err = AEAD_DECRYPT(pt1, ct1, data_len, tag1, ad1, ad_len,
				   nonce1, nonce_len, key);
		KUNIT_ASSERT_EQ(test, 0, err);

		err = AEAD_PREPAREKEY(key, raw_key2, key_len, tag_len);
		KUNIT_ASSERT_EQ(test, 0, err);
		err = AEAD_DECRYPT(pt2, ct2, data_len, tag2, ad2, ad_len,
				   nonce2, nonce_len, key);
		KUNIT_ASSERT_EQ(test, 0, err);

		KUNIT_ASSERT_MEMEQ(test, pt1, pt2, data_len);
	}
}

static void test_aead_inplace(struct kunit *test)
{
	const size_t max_data_len = 1024;
	const size_t max_ad_len = 512;
	const size_t nonce_len = AEAD_MAX_NONCE_LEN;
	size_t tag_len;
	struct AEAD_KEY *key = aead_alloc_random_key(test, &tag_len);
	u8 *data = aead_alloc_random_data(test, max_data_len + tag_len);
	u8 *data2 = alloc_buf(test, max_data_len + tag_len);
	u8 *ad = aead_alloc_random_data(test, max_ad_len);
	const u8 *nonce = aead_alloc_random_data(test, nonce_len);

	for (int i = 0; i < 100; i++) {
		size_t data_len = rand_length(max_data_len);
		size_t ad_len = rand_length(max_ad_len);
		int err;

		/* Encrypt out-of-place. */
		err = AEAD_ENCRYPT(data2, data, data_len, data2 + data_len, ad,
				   ad_len, nonce, nonce_len, key);
		KUNIT_ASSERT_EQ(test, 0, err);

		/* Encrypt in-place. */
		err = AEAD_ENCRYPT(data, data, data_len, data + data_len, ad,
				   ad_len, nonce, nonce_len, key);
		KUNIT_ASSERT_EQ(test, 0, err);

		/* Compare the results. */
		KUNIT_ASSERT_MEMEQ(test, data2, data, data_len + tag_len);

		/* Decrypt out-of-place. */
		err = AEAD_DECRYPT(data2, data, data_len, data + data_len, ad,
				   ad_len, nonce, nonce_len, key);
		KUNIT_ASSERT_EQ(test, 0, err);

		/* Decrypt in-place. */
		err = AEAD_DECRYPT(data, data, data_len, data + data_len, ad,
				   ad_len, nonce, nonce_len, key);
		KUNIT_ASSERT_EQ(test, 0, err);

		/* Compare the results. */
		KUNIT_ASSERT_MEMEQ(test, data2, data, data_len);
	}
}

/*
 * Monte-Carlo test for AEAD algorithms.  This deterministically generates
 * random AEAD inputs, encrypts them, verifies decryption, and computes and
 * verifies the checksum of all computed (ciphertext, tag) pairs.
 */
static void test_aead_monte_carlo(struct kunit *test)
{
	const size_t max_data_len = 1024;
	const size_t max_ad_len = 293;
	u8 raw_key[AEAD_MAX_KEY_LEN];
	u8 nonce[AEAD_MAX_NONCE_LEN];
	u8 tag[AEAD_MAX_TAG_LEN];
	u8 *pt = alloc_buf(test, max_data_len);
	u8 *ct = alloc_buf(test, max_data_len);
	u8 *decrypted = alloc_buf(test, max_data_len);
	u8 *ad = alloc_buf(test, max_ad_len);
	struct AEAD_KEY *key = alloc_buf(test, sizeof(*key));
	struct blake2s_ctx checksum_ctx;
	u8 actual_checksum[BLAKE2S_HASH_SIZE];
	int err;

	blake2s_init(&checksum_ctx, BLAKE2S_HASH_SIZE);

	for (size_t data_len = 0; data_len <= max_data_len; data_len++) {
		size_t ad_len = data_len % max_ad_len;
		size_t key_len =
			AEAD_VALID_KEY_LENS[data_len %
					    ARRAY_SIZE(AEAD_VALID_KEY_LENS)];
		size_t nonce_len =
			AEAD_VALID_NONCE_LENS[data_len %
					      ARRAY_SIZE(AEAD_VALID_NONCE_LENS)];
		size_t tag_len =
			AEAD_VALID_TAG_LENS[data_len %
					    ARRAY_SIZE(AEAD_VALID_TAG_LENS)];

		rand_bytes_seeded_from_len(pt, data_len);
		rand_bytes_seeded_from_len(ad, ad_len);
		rand_bytes_seeded_from_len(raw_key, key_len);
		rand_bytes_seeded_from_len(nonce, nonce_len);

		err = AEAD_PREPAREKEY(key, raw_key, key_len, tag_len);
		KUNIT_ASSERT_EQ(test, 0, err);

		err = AEAD_ENCRYPT(ct, pt, data_len, tag, ad, ad_len, nonce,
				   nonce_len, key);
		KUNIT_ASSERT_EQ_MSG(
			test, 0, err,
			"Encryption failed with data_len=%zu, ad_len=%zu",
			data_len, ad_len);
		err = AEAD_DECRYPT(decrypted, ct, data_len, tag, ad, ad_len,
				   nonce, nonce_len, key);
		KUNIT_ASSERT_EQ_MSG(
			test, 0, err,
			"Decryption failed with data_len=%zu, ad_len=%zu",
			data_len, ad_len);
		KUNIT_ASSERT_MEMEQ_MSG(
			test, pt, decrypted, data_len,
			"Decryption didn't invert encryption; data_len=%zu, ad_len=%zu",
			data_len, ad_len);

		blake2s_update(&checksum_ctx, ct, data_len);
		blake2s_update(&checksum_ctx, tag, tag_len);
	}

	blake2s_final(&checksum_ctx, actual_checksum);
	KUNIT_EXPECT_MEMEQ_MSG(test, actual_checksum, AEAD_MONTE_CARLO_CHECKSUM,
			       BLAKE2S_HASH_SIZE,
			       "Monte-Carlo checksum mismatch");
}

#define IRQ_TEST_DATA_LEN 256
#define IRQ_TEST_NUM_BUFFERS 3 /* matches max concurrency level */

struct aead_irq_test_slot {
	/* Fields written only at test case initialization time */
	u8 raw_key[AEAD_MAX_KEY_LEN];
	u8 nonce[AEAD_MAX_NONCE_LEN];
	u8 pt[IRQ_TEST_DATA_LEN];
	u8 ct[IRQ_TEST_DATA_LEN + AEAD_MAX_TAG_LEN];
	u8 ad[IRQ_TEST_DATA_LEN];

	/* Fields written throughout the test case */
	struct AEAD_KEY key;
	u8 scratch_buf[IRQ_TEST_DATA_LEN + AEAD_MAX_TAG_LEN];
	int phase;
	atomic_t in_use;
};

struct aead_irq_test_state {
	struct aead_irq_test_slot slots[IRQ_TEST_NUM_BUFFERS];
};

static bool aead_irq_test_func(void *state_)
{
	struct aead_irq_test_state *state = state_;
	struct aead_irq_test_slot *slot;
	size_t data_len;
	bool ok = true;

	/*
	 * Find a free slot.  This should always succeed, since the number of
	 * slots is equal to the max concurrency level of kunit_run_irq_test().
	 */
	for (slot = &state->slots[0];
	     slot < &state->slots[ARRAY_SIZE(state->slots)]; slot++) {
		if (atomic_cmpxchg(&slot->in_use, 0, 1) == 0)
			break;
	}
	if (WARN_ON_ONCE(slot == &state->slots[ARRAY_SIZE(state->slots)]))
		return false;
	/*
	 * This execution context now has exclusive access to 'slot'.
	 * Next, execute the next operation that the slot is set to perform.
	 */

	data_len = sizeof(slot->pt);
	if (slot->phase == 0) {
		/* Phase 0: Prepare slot's key in current context. */
		ok = ok && AEAD_PREPAREKEY(&slot->key, slot->raw_key,
					   sizeof(slot->raw_key),
					   AEAD_MAX_TAG_LEN) == 0;
	} else if (slot->phase == 1) {
		/*
		 * Phase 1: Encrypt plaintext using key that may have been
		 * prepared in a different context.
		 */
		ok = ok && AEAD_ENCRYPT(slot->scratch_buf, slot->pt, data_len,
					&slot->scratch_buf[data_len], slot->ad,
					sizeof(slot->ad), slot->nonce,
					sizeof(slot->nonce), &slot->key) == 0;
		/* Verify the ciphertext (with concatenated auth tag) matches */
		ok = ok &&
		     memcmp(slot->scratch_buf, slot->ct, sizeof(slot->ct)) == 0;
	} else {
		/*
		 * Phase 2: Decrypt ciphertext using key that may have been
		 * prepared in a different context.
		 */
		ok = ok && AEAD_DECRYPT(slot->scratch_buf, slot->ct, data_len,
					&slot->ct[data_len], slot->ad,
					sizeof(slot->ad), slot->nonce,
					sizeof(slot->nonce), &slot->key) == 0;
		/* Verify the plaintext matches. */
		ok = ok && memcmp(slot->scratch_buf, slot->pt, data_len) == 0;
	}
	slot->phase = (slot->phase + 1) % 3;
	atomic_set_release(&slot->in_use, 0);
	return ok;
}

/*
 * Test that encryption and decryption produce the correct results in task,
 * softirq, and hardirq contexts running concurrently -- including with keys
 * prepared in other contexts.  This is needed to cover fallback code paths that
 * execute in contexts where FPU or vector registers cannot be used.
 */
static void test_aead_interrupt_context(struct kunit *test)
{
	struct aead_irq_test_state *state = alloc_buf(test, sizeof(*state));

	memset(state, 0, sizeof(*state));

	/*
	 * For each slot, generate a set of AEAD inputs: a key, a nonce, a
	 * plaintext, and some associated data.  Then generate the corresponding
	 * ciphertext with concatenated auth tag.
	 */
	for (int i = 0; i < IRQ_TEST_NUM_BUFFERS; i++) {
		struct aead_irq_test_slot *slot = &state->slots[i];
		int err;

		rand_bytes(slot->raw_key, sizeof(slot->raw_key));
		rand_bytes(slot->nonce, sizeof(slot->nonce));
		rand_bytes(slot->pt, sizeof(slot->pt));
		rand_bytes(slot->ad, sizeof(slot->ad));
		err = AEAD_PREPAREKEY(&slot->key, slot->raw_key,
				      sizeof(slot->raw_key), AEAD_MAX_TAG_LEN);
		KUNIT_ASSERT_EQ(test, 0, err);
		err = AEAD_ENCRYPT(slot->ct, slot->pt, sizeof(slot->pt),
				   &slot->ct[sizeof(slot->pt)], slot->ad,
				   sizeof(slot->ad), slot->nonce,
				   sizeof(slot->nonce), &slot->key);
		KUNIT_ASSERT_EQ(test, 0, err);
	}

	kunit_run_irq_test(test, aead_irq_test_func, 100000, state);
}

/* Benchmark AEAD encryption and decryption on various data lengths. */
static void benchmark_aead(struct kunit *test)
{
	static const size_t data_lens_to_test[] = {
		16, 64, 128, 256, 512, 1024, 1420, 4096, 16384,
	};
	const size_t max_data_len = 16384;
	const size_t ad_len = 16;
	const size_t key_len = AEAD_MAX_KEY_LEN;
	const size_t nonce_len = AEAD_MAX_NONCE_LEN;
	const size_t tag_len = AEAD_MAX_TAG_LEN;
	const u8 *raw_key, *nonce, *ad;
	u8 *pt, *ct, *tag;
	struct AEAD_KEY *key;
	int err;

	if (!IS_ENABLED(CONFIG_CRYPTO_LIB_BENCHMARK))
		kunit_skip(test, "not enabled");

	raw_key = aead_alloc_random_data(test, key_len);
	nonce = aead_alloc_random_data(test, nonce_len);
	ad = aead_alloc_random_data(test, ad_len);
	pt = aead_alloc_random_data(test, max_data_len);
	ct = alloc_buf(test, max_data_len);
	tag = alloc_buf(test, tag_len);

	key = alloc_buf(test, sizeof(*key));
	err = AEAD_PREPAREKEY(key, raw_key, key_len, tag_len);
	KUNIT_ASSERT_EQ(test, 0, err);

	/* Warm-up */
	for (size_t i = 0; i < 10000000; i += max_data_len) {
		err = AEAD_ENCRYPT(ct, pt, max_data_len, tag, ad, ad_len, nonce,
				   nonce_len, key);
		KUNIT_ASSERT_EQ(test, 0, err);
		err = AEAD_DECRYPT(pt, ct, max_data_len, tag, ad, ad_len, nonce,
				   nonce_len, key);
		KUNIT_ASSERT_EQ(test, 0, err);
	}

	for (size_t i = 0; i < ARRAY_SIZE(data_lens_to_test); i++) {
		size_t data_len = data_lens_to_test[i];
		size_t num_iters = 10000000 / (data_len + 128);
		u64 t_enc, t_dec;
		bool ok = true;

		KUNIT_ASSERT_LE(test, data_len, max_data_len);

		preempt_disable();

		t_enc = ktime_get_ns();
		for (size_t j = 0; j < num_iters; j++) {
			err = AEAD_ENCRYPT(ct, pt, data_len, tag, ad, ad_len,
					   nonce, nonce_len, key);
			ok &= (err == 0);
		}
		t_enc = ktime_get_ns() - t_enc;

		t_dec = ktime_get_ns();
		for (size_t j = 0; j < num_iters; j++) {
			err = AEAD_DECRYPT(pt, ct, data_len, tag, ad, ad_len,
					   nonce, nonce_len, key);
			ok &= (err == 0);
		}
		t_dec = ktime_get_ns() - t_dec;

		preempt_enable();

		KUNIT_ASSERT_TRUE_MSG(test, ok, "data_len=%zu", data_len);

		kunit_info(test, "data_len=%zu: enc %llu MB/s, dec %llu MB/s",
			   data_len,
			   div64_u64((u64)data_len * num_iters * 1000,
				     t_enc ?: 1),
			   div64_u64((u64)data_len * num_iters * 1000,
				     t_dec ?: 1));
	}
}

/* clang-format off */
#define AEAD_KUNIT_CASES				\
	KUNIT_CASE(test_aead_all_key_lens),		\
	KUNIT_CASE(test_aead_all_nonce_lens),		\
	KUNIT_CASE(test_aead_all_tag_lens),		\
	KUNIT_CASE(test_aead_incremental_updates),	\
	KUNIT_CASE(test_aead_data_buffer_overruns),	\
	KUNIT_CASE(test_aead_alignment_consistency),	\
	KUNIT_CASE(test_aead_inplace),			\
	KUNIT_CASE(test_aead_monte_carlo),		\
	KUNIT_CASE(test_aead_interrupt_context),	\
	KUNIT_CASE(benchmark_aead)