[PATCH] lib/crypto: tests: Drop the default to CRYPTO_SELFTESTS

[Eric Biggers]

Defaulting the crypto KUnit tests to KUNIT_ALL_TESTS || CRYPTO_SELFTESTS
instead of simply KUNIT_ALL_TESTS was originally intended to make it
easy to enable all the crypto KUnit tests. This additional default is
nonstandard for KUnit tests, though, and it can cause all the KUnit
tests to be built-in unexpectedly if CRYPTO_SELFTESTS is set. It also
constitutes a back-reference to crypto/ from lib/crypto/, which is
something that we should be avoiding in order to get clean layering.

Now that we provide a lib/crypto/.kunitconfig file that enables all
crypto KUnit tests, let's consider that to be the supported way to
enable all these tests, and drop the default of CRYPTO_SELFTESTS.

Signed-off-by: Eric Biggers <ebig...@kernel.org>
---

This patch is targeting libcrypto-next

lib/crypto/tests/Kconfig | 26 +++++++++++++-------------
1 file changed, 13 insertions(+), 13 deletions(-)

diff --git a/lib/crypto/tests/Kconfig b/lib/crypto/tests/Kconfig
index 0d71de3da15d..144b98fcbb50 100644
--- a/lib/crypto/tests/Kconfig
+++ b/lib/crypto/tests/Kconfig
@@ -1,117 +1,117 @@
# SPDX-License-Identifier: GPL-2.0-or-later

config CRYPTO_LIB_AES_CBC_MACS_KUNIT_TEST
tristate "KUnit tests for AES-CMAC, AES-XCBC-MAC, and AES-CBC-MAC" if !KUNIT_ALL_TESTS
depends on KUNIT && CRYPTO_LIB_AES_CBC_MACS
- default KUNIT_ALL_TESTS || CRYPTO_SELFTESTS
+ default KUNIT_ALL_TESTS
select CRYPTO_LIB_BENCHMARK_VISIBLE
help
KUnit tests for the AES-CMAC, AES-XCBC-MAC, and AES-CBC-MAC message
authentication codes.

config CRYPTO_LIB_BLAKE2B_KUNIT_TEST
tristate "KUnit tests for BLAKE2b" if !KUNIT_ALL_TESTS
depends on KUNIT && CRYPTO_LIB_BLAKE2B
- default KUNIT_ALL_TESTS || CRYPTO_SELFTESTS
+ default KUNIT_ALL_TESTS
select CRYPTO_LIB_BENCHMARK_VISIBLE
help
KUnit tests for the BLAKE2b cryptographic hash function.

config CRYPTO_LIB_BLAKE2S_KUNIT_TEST
tristate "KUnit tests for BLAKE2s" if !KUNIT_ALL_TESTS
depends on KUNIT
- default KUNIT_ALL_TESTS || CRYPTO_SELFTESTS
+ default KUNIT_ALL_TESTS
select CRYPTO_LIB_BENCHMARK_VISIBLE
# No need to depend on CRYPTO_LIB_BLAKE2S here, as that option doesn't
# exist; the BLAKE2s code is always built-in for the /dev/random driver.
help
KUnit tests for the BLAKE2s cryptographic hash function.

config CRYPTO_LIB_CURVE25519_KUNIT_TEST
tristate "KUnit tests for Curve25519" if !KUNIT_ALL_TESTS
depends on KUNIT && CRYPTO_LIB_CURVE25519
- default KUNIT_ALL_TESTS || CRYPTO_SELFTESTS
+ default KUNIT_ALL_TESTS
select CRYPTO_LIB_BENCHMARK_VISIBLE
help
KUnit tests for the Curve25519 Diffie-Hellman function.

config CRYPTO_LIB_MD5_KUNIT_TEST
tristate "KUnit tests for MD5" if !KUNIT_ALL_TESTS
depends on KUNIT && CRYPTO_LIB_MD5
- default KUNIT_ALL_TESTS || CRYPTO_SELFTESTS
+ default KUNIT_ALL_TESTS
select CRYPTO_LIB_BENCHMARK_VISIBLE
help
KUnit tests for the MD5 cryptographic hash function and its
corresponding HMAC.

config CRYPTO_LIB_MLDSA_KUNIT_TEST
tristate "KUnit tests for ML-DSA" if !KUNIT_ALL_TESTS
depends on KUNIT && CRYPTO_LIB_MLDSA
- default KUNIT_ALL_TESTS || CRYPTO_SELFTESTS
+ default KUNIT_ALL_TESTS
select CRYPTO_LIB_BENCHMARK_VISIBLE
help
KUnit tests for the ML-DSA digital signature algorithm.

config CRYPTO_LIB_NH_KUNIT_TEST
tristate "KUnit tests for NH" if !KUNIT_ALL_TESTS
depends on KUNIT && CRYPTO_LIB_NH
- default KUNIT_ALL_TESTS || CRYPTO_SELFTESTS
+ default KUNIT_ALL_TESTS
help
KUnit tests for the NH almost-universal hash function.

config CRYPTO_LIB_POLY1305_KUNIT_TEST
tristate "KUnit tests for Poly1305" if !KUNIT_ALL_TESTS
depends on KUNIT && CRYPTO_LIB_POLY1305
- default KUNIT_ALL_TESTS || CRYPTO_SELFTESTS
+ default KUNIT_ALL_TESTS
select CRYPTO_LIB_BENCHMARK_VISIBLE
help
KUnit tests for the Poly1305 library functions.

config CRYPTO_LIB_POLYVAL_KUNIT_TEST
tristate "KUnit tests for POLYVAL" if !KUNIT_ALL_TESTS
depends on KUNIT && CRYPTO_LIB_POLYVAL
- default KUNIT_ALL_TESTS || CRYPTO_SELFTESTS
+ default KUNIT_ALL_TESTS
select CRYPTO_LIB_BENCHMARK_VISIBLE
help
KUnit tests for the POLYVAL library functions.

config CRYPTO_LIB_SHA1_KUNIT_TEST
tristate "KUnit tests for SHA-1" if !KUNIT_ALL_TESTS
depends on KUNIT && CRYPTO_LIB_SHA1
- default KUNIT_ALL_TESTS || CRYPTO_SELFTESTS
+ default KUNIT_ALL_TESTS
select CRYPTO_LIB_BENCHMARK_VISIBLE
help
KUnit tests for the SHA-1 cryptographic hash function and its
corresponding HMAC.

# Option is named *_SHA256_KUNIT_TEST, though both SHA-224 and SHA-256 tests are
# included, for consistency with the naming used elsewhere (e.g. CRYPTO_SHA256).
config CRYPTO_LIB_SHA256_KUNIT_TEST
tristate "KUnit tests for SHA-224 and SHA-256" if !KUNIT_ALL_TESTS
depends on KUNIT && CRYPTO_LIB_SHA256
- default KUNIT_ALL_TESTS || CRYPTO_SELFTESTS
+ default KUNIT_ALL_TESTS
select CRYPTO_LIB_BENCHMARK_VISIBLE
help
KUnit tests for the SHA-224 and SHA-256 cryptographic hash functions
and their corresponding HMACs.

# Option is named *_SHA512_KUNIT_TEST, though both SHA-384 and SHA-512 tests are
# included, for consistency with the naming used elsewhere (e.g. CRYPTO_SHA512).
config CRYPTO_LIB_SHA512_KUNIT_TEST
tristate "KUnit tests for SHA-384 and SHA-512" if !KUNIT_ALL_TESTS
depends on KUNIT && CRYPTO_LIB_SHA512
- default KUNIT_ALL_TESTS || CRYPTO_SELFTESTS
+ default KUNIT_ALL_TESTS
select CRYPTO_LIB_BENCHMARK_VISIBLE
help
KUnit tests for the SHA-384 and SHA-512 cryptographic hash functions
and their corresponding HMACs.

config CRYPTO_LIB_SHA3_KUNIT_TEST
tristate "KUnit tests for SHA-3" if !KUNIT_ALL_TESTS
depends on KUNIT && CRYPTO_LIB_SHA3
- default KUNIT_ALL_TESTS || CRYPTO_SELFTESTS
+ default KUNIT_ALL_TESTS
select CRYPTO_LIB_BENCHMARK_VISIBLE
help
KUnit tests for the SHA3 cryptographic hash and XOF functions,
including SHA3-224, SHA3-256, SHA3-384, SHA3-512, SHAKE128 and
SHAKE256.

base-commit: 44a3873df8114546a76ead737f64b57ae7676cc2
--
2.53.0

[Ard Biesheuvel]

On Tue, 17 Mar 2026, at 05:06, Eric Biggers wrote:
> Defaulting the crypto KUnit tests to KUNIT_ALL_TESTS || CRYPTO_SELFTESTS
> instead of simply KUNIT_ALL_TESTS was originally intended to make it
> easy to enable all the crypto KUnit tests. This additional default is
> nonstandard for KUnit tests, though, and it can cause all the KUnit
> tests to be built-in unexpectedly if CRYPTO_SELFTESTS is set. It also
> constitutes a back-reference to crypto/ from lib/crypto/, which is
> something that we should be avoiding in order to get clean layering.
>
> Now that we provide a lib/crypto/.kunitconfig file that enables all
> crypto KUnit tests, let's consider that to be the supported way to
> enable all these tests, and drop the default of CRYPTO_SELFTESTS.
>
> Signed-off-by: Eric Biggers <ebig...@kernel.org>
> ---
>
> This patch is targeting libcrypto-next
>
> lib/crypto/tests/Kconfig | 26 +++++++++++++-------------
> 1 file changed, 13 insertions(+), 13 deletions(-)
>

Acked-by: Ard Biesheuvel <ar...@kernel.org>

[Eric Biggers]

On Mon, Mar 16, 2026 at 09:06:26PM -0700, Eric Biggers wrote:
> Defaulting the crypto KUnit tests to KUNIT_ALL_TESTS || CRYPTO_SELFTESTS
> instead of simply KUNIT_ALL_TESTS was originally intended to make it
> easy to enable all the crypto KUnit tests. This additional default is
> nonstandard for KUnit tests, though, and it can cause all the KUnit
> tests to be built-in unexpectedly if CRYPTO_SELFTESTS is set. It also
> constitutes a back-reference to crypto/ from lib/crypto/, which is
> something that we should be avoiding in order to get clean layering.
>
> Now that we provide a lib/crypto/.kunitconfig file that enables all
> crypto KUnit tests, let's consider that to be the supported way to
> enable all these tests, and drop the default of CRYPTO_SELFTESTS.
>
> Signed-off-by: Eric Biggers <ebig...@kernel.org>
> ---
>
> This patch is targeting libcrypto-next

Applied to https://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux.git/log/?h=libcrypto-next

- Eric