Re: [PATCH] Documentation: libcrypto: Add additional testing information

[Ard Biesheuvel]

On Fri, 25 Sep 2026, at 07:25, Eric Biggers wrote:
> Link to the KUnit documentation, mention the existence of the benchmarks
> and how to enable them, explicitly mention that the tests can be run on
> real hardware, and mention that it's often possible to clear CPU
> features via the kernel command line.
>
> Signed-off-by: Eric Biggers <ebiggers@xxxxxxxxxx>
> ---
>
> This patch is intended to be taken through libcrypto-next
>
>  Documentation/crypto/libcrypto.rst | 13 +++++++++++++
>  1 file changed, 13 insertions(+)
>

Acked-by: Ard Biesheuvel <ardb@xxxxxxxxxx>

> diff --git a/Documentation/crypto/libcrypto.rst 
> b/Documentation/crypto/libcrypto.rst
> index e911e0521597..53037e62728e 100644
> --- a/Documentation/crypto/libcrypto.rst
> +++ b/Documentation/crypto/libcrypto.rst
> @@ -127,6 +127,8 @@ The crypto library uses standard KUnit tests.  Like 
> many of the kernel's other
>  KUnit tests, they are included in the set of tests that is run by
>  ``tools/testing/kunit/kunit.py run --alltests``.
> 
> +For more information about KUnit, see Documentation/dev-tools/kunit/start.rst.
> +
>  A ``.kunitconfig`` file is also provided to run just the crypto library tests.
>  For example, here's how to run them in user-mode Linux:
> 
> @@ -148,6 +150,17 @@ emulate the correct type of hardware for the code 
> to be reached.
>  Since correctness is essential in cryptographic code, new 
> architecture-optimized
>  code is accepted only if it can be tested in QEMU.
> 
> +Most of the crypto KUnit tests also include benchmarks.  To enable 
> these, enable
> +``CONFIG_CRYPTO_LIB_BENCHMARK=y`` (in addition to the tests 
> themselves).  The
> +benchmark results are printed to the kernel log when the test runs.
> +
> +Of course, the crypto KUnit tests can also be run on real hardware.  
> Note that
> +it is generally still possible to test and benchmark non-default code 
> paths in
> +this case (for example, the software implementation of AES when the 
> CPU has
> +hardware-accelerated AES), since on many architectures the kernel 
> supports
> +disabling CPU features via the kernel command line.  For example, on 
> x86,
> +the ``clearcpuid=aes`` kernel command line option disables AES 
> acceleration.
> +
>  Note: the crypto library also includes FIPS 140 self-tests.  These are
>  lightweight, are designed specifically to meet FIPS 140 requirements, 
> and exist
>  *only* to meet those requirements.  Normal testing done by kernel 
> developers and
>
> base-commit: 165768bb70265b5c38cf0b73fafd75be235f8b14
> -- 
> 2.55.0