[PATCH] lib/crypto: tests: Depend on library options rather than selecting them

[Eric Biggers]

The convention for KUnit tests is to have the test kconfig options
visible only when the code they depend on is already enabled. This way
only the tests that are relevant to the particular kernel build can be
enabled, either manually or via KUNIT_ALL_TESTS.

Update lib/crypto/tests/Kconfig to follow that convention, i.e. depend
on the corresponding library options rather than selecting them. This
fixes an issue where enabling KUNIT_ALL_TESTS enabled non-test code.

This does mean that it becomes more difficult to enable *all* the crypto
library tests (which is what I do as a maintainer of the code), since
doing so will now require enabling other options that select the
libraries. Regardless, we should follow the standard KUnit convention.

Note: currently most of the crypto library options are selected by
visible options in crypto/Kconfig, which can be used to enable them
without too much trouble. If in the future we end up with more cases
like CRYPTO_LIB_CURVE25519 which is selected only by WIREGUARD (thus
making CRYPTO_LIB_CURVE25519_KUNIT_TEST effectively depend on WIREGUARD
after this commit), we could consider adding a new kconfig option that
enables all the library code specifically for testing.

Reported-by: Geert Uytterhoeven <ge...@linux-m68k.org>
Closes: https://lore.kernel.org/r/CAMuHMdVFRQZXCKJBOBDJtpEN...@mail.gmail.com
Fixes: 4dcf6caddaa0 ("lib/crypto: tests: Add KUnit tests for SHA-224 and SHA-256")
Fixes: 571eaeddb67d ("lib/crypto: tests: Add KUnit tests for SHA-384 and SHA-512")
Fixes: 6dd4d9f7919e ("lib/crypto: tests: Add KUnit tests for Poly1305")
Fixes: 66b130607908 ("lib/crypto: tests: Add KUnit tests for SHA-1 and HMAC-SHA1")
Fixes: d6b6aac0cdb4 ("lib/crypto: tests: Add KUnit tests for MD5 and HMAC-MD5")
Fixes: afc4e4a5f122 ("lib/crypto: tests: Migrate Curve25519 self-test to KUnit")
Fixes: 6401fd334ddf ("lib/crypto: tests: Add KUnit tests for BLAKE2b")
Fixes: 15c64c47e484 ("lib/crypto: tests: Add SHA3 kunit tests")
Fixes: b3aed551b3fc ("lib/crypto: tests: Add KUnit tests for POLYVAL")
Fixes: ed894faccb8d ("lib/crypto: tests: Add KUnit tests for ML-DSA verification")
Fixes: 7246fe6cd644 ("lib/crypto: tests: Add KUnit tests for NH")
Cc: sta...@vger.kernel.org
Signed-off-by: Eric Biggers <ebig...@kernel.org>
---

This patch applies to v7.0-rc1 and is targeting libcrypto-fixes

lib/crypto/tests/Kconfig | 35 ++++++++++++-----------------------
1 file changed, 12 insertions(+), 23 deletions(-)

diff --git a/lib/crypto/tests/Kconfig b/lib/crypto/tests/Kconfig
index 4970463ea0aaa..0de289b429a95 100644
--- a/lib/crypto/tests/Kconfig
+++ b/lib/crypto/tests/Kconfig
@@ -1,120 +1,109 @@
# SPDX-License-Identifier: GPL-2.0-or-later

config CRYPTO_LIB_BLAKE2B_KUNIT_TEST
tristate "KUnit tests for BLAKE2b" if !KUNIT_ALL_TESTS
- depends on KUNIT
+ depends on KUNIT && CRYPTO_LIB_BLAKE2B
default KUNIT_ALL_TESTS || CRYPTO_SELFTESTS
select CRYPTO_LIB_BENCHMARK_VISIBLE
- select CRYPTO_LIB_BLAKE2B
help
KUnit tests for the BLAKE2b cryptographic hash function.

config CRYPTO_LIB_BLAKE2S_KUNIT_TEST
tristate "KUnit tests for BLAKE2s" if !KUNIT_ALL_TESTS
depends on KUNIT
default KUNIT_ALL_TESTS || CRYPTO_SELFTESTS
select CRYPTO_LIB_BENCHMARK_VISIBLE
- # No need to select CRYPTO_LIB_BLAKE2S here, as that option doesn't
+ # No need to depend on CRYPTO_LIB_BLAKE2S here, as that option doesn't
# exist; the BLAKE2s code is always built-in for the /dev/random driver.
help
KUnit tests for the BLAKE2s cryptographic hash function.

config CRYPTO_LIB_CURVE25519_KUNIT_TEST
tristate "KUnit tests for Curve25519" if !KUNIT_ALL_TESTS
- depends on KUNIT
+ depends on KUNIT && CRYPTO_LIB_CURVE25519
default KUNIT_ALL_TESTS || CRYPTO_SELFTESTS
select CRYPTO_LIB_BENCHMARK_VISIBLE
- select CRYPTO_LIB_CURVE25519
help
KUnit tests for the Curve25519 Diffie-Hellman function.

config CRYPTO_LIB_MD5_KUNIT_TEST
tristate "KUnit tests for MD5" if !KUNIT_ALL_TESTS
- depends on KUNIT
+ depends on KUNIT && CRYPTO_LIB_MD5
default KUNIT_ALL_TESTS || CRYPTO_SELFTESTS
select CRYPTO_LIB_BENCHMARK_VISIBLE
- select CRYPTO_LIB_MD5
help
KUnit tests for the MD5 cryptographic hash function and its
corresponding HMAC.

config CRYPTO_LIB_MLDSA_KUNIT_TEST
tristate "KUnit tests for ML-DSA" if !KUNIT_ALL_TESTS
- depends on KUNIT
+ depends on KUNIT && CRYPTO_LIB_MLDSA
default KUNIT_ALL_TESTS || CRYPTO_SELFTESTS
select CRYPTO_LIB_BENCHMARK_VISIBLE
- select CRYPTO_LIB_MLDSA
help
KUnit tests for the ML-DSA digital signature algorithm.

config CRYPTO_LIB_NH_KUNIT_TEST
tristate "KUnit tests for NH" if !KUNIT_ALL_TESTS
- depends on KUNIT
+ depends on KUNIT && CRYPTO_LIB_NH
default KUNIT_ALL_TESTS || CRYPTO_SELFTESTS
- select CRYPTO_LIB_NH
help
KUnit tests for the NH almost-universal hash function.

config CRYPTO_LIB_POLY1305_KUNIT_TEST
tristate "KUnit tests for Poly1305" if !KUNIT_ALL_TESTS
- depends on KUNIT
+ depends on KUNIT && CRYPTO_LIB_POLY1305
default KUNIT_ALL_TESTS || CRYPTO_SELFTESTS
select CRYPTO_LIB_BENCHMARK_VISIBLE
- select CRYPTO_LIB_POLY1305
help
KUnit tests for the Poly1305 library functions.

config CRYPTO_LIB_POLYVAL_KUNIT_TEST
tristate "KUnit tests for POLYVAL" if !KUNIT_ALL_TESTS
- depends on KUNIT
+ depends on KUNIT && CRYPTO_LIB_POLYVAL
default KUNIT_ALL_TESTS || CRYPTO_SELFTESTS
select CRYPTO_LIB_BENCHMARK_VISIBLE
- select CRYPTO_LIB_POLYVAL
help
KUnit tests for the POLYVAL library functions.

config CRYPTO_LIB_SHA1_KUNIT_TEST
tristate "KUnit tests for SHA-1" if !KUNIT_ALL_TESTS
- depends on KUNIT
+ depends on KUNIT && CRYPTO_LIB_SHA1
default KUNIT_ALL_TESTS || CRYPTO_SELFTESTS
select CRYPTO_LIB_BENCHMARK_VISIBLE
- select CRYPTO_LIB_SHA1
help
KUnit tests for the SHA-1 cryptographic hash function and its
corresponding HMAC.

# Option is named *_SHA256_KUNIT_TEST, though both SHA-224 and SHA-256 tests are
# included, for consistency with the naming used elsewhere (e.g. CRYPTO_SHA256).
config CRYPTO_LIB_SHA256_KUNIT_TEST
tristate "KUnit tests for SHA-224 and SHA-256" if !KUNIT_ALL_TESTS
- depends on KUNIT
+ depends on KUNIT && CRYPTO_LIB_SHA256
default KUNIT_ALL_TESTS || CRYPTO_SELFTESTS
select CRYPTO_LIB_BENCHMARK_VISIBLE
- select CRYPTO_LIB_SHA256
help
KUnit tests for the SHA-224 and SHA-256 cryptographic hash functions
and their corresponding HMACs.

# Option is named *_SHA512_KUNIT_TEST, though both SHA-384 and SHA-512 tests are
# included, for consistency with the naming used elsewhere (e.g. CRYPTO_SHA512).
config CRYPTO_LIB_SHA512_KUNIT_TEST
tristate "KUnit tests for SHA-384 and SHA-512" if !KUNIT_ALL_TESTS
- depends on KUNIT
+ depends on KUNIT && CRYPTO_LIB_SHA512
default KUNIT_ALL_TESTS || CRYPTO_SELFTESTS
select CRYPTO_LIB_BENCHMARK_VISIBLE
- select CRYPTO_LIB_SHA512
help
KUnit tests for the SHA-384 and SHA-512 cryptographic hash functions
and their corresponding HMACs.

config CRYPTO_LIB_SHA3_KUNIT_TEST
tristate "KUnit tests for SHA-3" if !KUNIT_ALL_TESTS
- depends on KUNIT
+ depends on KUNIT && CRYPTO_LIB_SHA3
default KUNIT_ALL_TESTS || CRYPTO_SELFTESTS
select CRYPTO_LIB_BENCHMARK_VISIBLE
- select CRYPTO_LIB_SHA3
help
KUnit tests for the SHA3 cryptographic hash and XOF functions,
including SHA3-224, SHA3-256, SHA3-384, SHA3-512, SHAKE128 and
SHAKE256.


base-commit: 6de23f81a5e08be8fbf5e8d7e9febc72a5b5f27f
--
2.53.0

[Ard Biesheuvel]

Acked-by: Ard Biesheuvel <ar...@kernel.org>

[Geert Uytterhoeven]

Hi Eric,

Thanks for your patch!

On Thu, 26 Feb 2026 at 20:20, Eric Biggers <ebig...@kernel.org> wrote:
> The convention for KUnit tests is to have the test kconfig options
> visible only when the code they depend on is already enabled. This way
> only the tests that are relevant to the particular kernel build can be
> enabled, either manually or via KUNIT_ALL_TESTS.
>
> Update lib/crypto/tests/Kconfig to follow that convention, i.e. depend
> on the corresponding library options rather than selecting them. This
> fixes an issue where enabling KUNIT_ALL_TESTS enabled non-test code.
>
> This does mean that it becomes more difficult to enable *all* the crypto
> library tests (which is what I do as a maintainer of the code), since
> doing so will now require enabling other options that select the
> libraries. Regardless, we should follow the standard KUnit convention.
>
> Note: currently most of the crypto library options are selected by
> visible options in crypto/Kconfig, which can be used to enable them
> without too much trouble. If in the future we end up with more cases
> like CRYPTO_LIB_CURVE25519 which is selected only by WIREGUARD (thus
> making CRYPTO_LIB_CURVE25519_KUNIT_TEST effectively depend on WIREGUARD
> after this commit), we could consider adding a new kconfig option that
> enables all the library code specifically for testing.

You can make those library symbols visible if KUNIT_ALL_TESTS, like
I suggested (after I sent my earlier reports to you) in [1], and like
Vladimir already did in [2].

> Reported-by: Geert Uytterhoeven <ge...@linux-m68k.org>
> Closes: https://lore.kernel.org/r/CAMuHMdVFRQZXCKJBOBDJtpEN...@mail.gmail.com

[1] "Re: [PATCH v3 net-next 05/10] phy: add phy_get_rx_polarity()
and phy_get_tx_polarity()"
https://lore.kernel.org/CAMuHMdUBaoYKNj52gn8DQeZF...@mail.gmail.com/
[2] "[PATCH phy-fixes] phy: make PHY_COMMON_PROPS Kconfig symbol
conditionally user-selectable"
https://lore.kernel.org/20260226153315.35303...@nxp.com/

Gr{oetje,eeting}s,

Geert

--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- ge...@linux-m68k.org

In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
-- Linus Torvalds

[David Gow]

Thanks -- I do think this is better, as we do run KUnit tests on pretty
minimal configurations.

One suggestion would be to have a crypto/.kunitconfig file which enables
all of these: you could then run the crypto tests with:
./tools/testing/kunit/kunit.py run --kunitconfig crypto/

Reviewed-by: David Gow <da...@davidgow.net>

Cheers,
-- David