examples: add Wycheproof validation app

Add a Wycheproof JSON vector validation example for cryptodev PMDs.

Support these algorithms when advertised by the selected PMD:
- AEAD: AES-GCM, AES-CCM, SM4-GCM, ChaCha20-Poly1305
- MAC: AES-CMAC, AES-GMAC, HMAC SHA-1/SHA-2/SHA-3/SM3
- Asymmetric: DSA (P1363 verify), ECDSA (P1363 verify), ECDH (ecpoint shared-secret compute)

Validate valid vectors against generated ciphertexts, tags, plaintexts, digests, shared secrets, or signature verification, and require the expected rejection for invalid vectors. Digest inputs for DSA and ECDSA use the symmetric auth path, selecting a separate symmetric-capable device when the target device is asymmetric-only.

Skip parameter combinations outside PMD capability ranges and identify recognized vector families without a compatible DPDK transform. A --debug option lists every failed or skipped vector.

Add Meson and standalone build integration, with usage documentation.

---
 examples/meson.build                       |    1 +
 examples/wycheproof_validation/Makefile    |   40 +
 examples/wycheproof_validation/README.md   |  124 ++
 examples/wycheproof_validation/main.c      | 1882 ++++++++++++++++++++
 examples/wycheproof_validation/meson.build |   17 +
 5 files changed, 2064 insertions(+)
 create mode 100644 examples/wycheproof_validation/Makefile
 create mode 100644 examples/wycheproof_validation/README.md
 create mode 100644 examples/wycheproof_validation/main.c
 create mode 100644 examples/wycheproof_validation/meson.build

index 25d9c88457..000d05863a 100644
@@ -59,6 +59,7 @@ all_examples = [
         'vm_power_manager/guest_cli',
         'vmdq',
         'vmdq_dcb',
+        'wycheproof_validation',
 ]
 
 # on install, skip copying all meson.build files

new file mode 100644
index 0000000000..c687282465
@@ -0,0 +1,40 @@
+# SPDX-License-Identifier: BSD-3-Clause
+# Copyright(c) 2026
+
+APP = wycheproof_validation
+SRCS-y := main.c
+
+PKGCONF ?= pkg-config
+
+ifneq ($(shell $(PKGCONF) --exists libdpdk && echo 0),0)
+$(error "no installation of DPDK found")
+endif
+ifneq ($(shell $(PKGCONF) --exists jansson && echo 0),0)
+$(error "Jansson is required")
+endif
+
+all: shared
+.PHONY: shared static
+shared: build/$(APP)-shared
+	ln -sf $(APP)-shared build/$(APP)
+static: build/$(APP)-static
+	ln -sf $(APP)-static build/$(APP)
+
+PC_FILE := $(shell $(PKGCONF) --path libdpdk 2>/dev/null)
+CFLAGS += -O3 $(shell $(PKGCONF) --cflags libdpdk jansson)
+LDFLAGS_SHARED = $(shell $(PKGCONF) --libs libdpdk jansson)
+LDFLAGS_STATIC = $(shell $(PKGCONF) --static --libs libdpdk jansson)
+
+build/$(APP)-shared: $(SRCS-y) Makefile $(PC_FILE) | build
+	$(CC) $(CFLAGS) $(SRCS-y) -o $@ $(LDFLAGS) $(LDFLAGS_SHARED)
+
+build/$(APP)-static: $(SRCS-y) Makefile $(PC_FILE) | build
+	$(CC) $(CFLAGS) $(SRCS-y) -o $@ $(LDFLAGS) $(LDFLAGS_STATIC)
+
+build:
+	@mkdir -p $@
+
+.PHONY: clean
+clean:
+	rm -f build/$(APP) build/$(APP)-static build/$(APP)-shared
+	test -d build && rmdir -p build || true
\ No newline at end of file

new file mode 100644
index 0000000000..7f18b4cef3
@@ -0,0 +1,17 @@
+# SPDX-License-Identifier: BSD-3-Clause
+# Copyright(c) 2026
+
+# meson file, for building this example as part of a main DPDK build.
+#
+# To build this example as a standalone application with an already-installed
+# DPDK instance, use 'make'
+
+deps += ['cryptodev']
+
+if not dpdk_conf.has('RTE_HAS_JANSSON')
+    build = false
+    message('Skipping wycheproof_validation: Jansson is required')
+else
+    ext_deps += jansson_dep
+    sources = files('main.c')
+endif

2.34.1

Fable found lots of issues that need addressing.

Review: [PATCH] examples: add Wycheproof validation app

Built with meson -Dwerror=true, gcc 13.3, crypto/openssl. Ran the app against Wycheproof v1 vectors (GCM, CCM, GMAC, HMAC, CMAC, DSA) with crypto_openssl after fixing the build error below; those pass.

Errors
------

1. Build fails with -Dwerror (test-meson-builds.sh default):

main.c:954,957: 'status' may be used uninitialized
main.c:1194: 'status' may be used uninitialized

process_gmac (decl line 929) and process_dsa_p1363 (line 1194) leave status uninitialized on the -ENOTSUP and non-valid/invalid paths. validate_aead_vector (decl line 740) has a real read: a non-zero ret from run_aead jumps to failed: and line 795 prints status. Initialize to RTE_CRYPTO_OP_STATUS_ERROR in all four places, as process_ecdh_ecpoint and process_ecdsa_p1363 already do.

2. CCM AAD buffer is too small, heap overflow on QAT (line 526):

       aad = rte_zmalloc(NULL, vector->aad_len + 18, 0);

rte_crypto_sym.h (aad_length) requires the 18-byte prefix plus padding so the allocation is a multiple of 16, and says PMDs may write the padding. QAT does: qat_crypto_pmd_gens.h ~1194-1206 memsets &aad_data[18 + aad_len] for 16 - (aad_len + 2) % 16 bytes. Every CCM vector with (aad_len + 2) % 16 != 0 (Wycheproof aad lengths 0, 1, 2, 7, 8, 15, 16, 17, ...) writes past the buffer. app/test uses RTE_ALIGN_CEIL(aad_len + 18, 16); do the same.

The guard on the next line is also wrong:

       if (aad == NULL && vector->aad_len != 0)

The allocation is never zero-size, so a NULL here means the PMD writes B0 and the flags byte through a NULL aad.data. Use if (aad == NULL).

Warnings
--------

3. EC operands passed at JSON width (lines 1548-1551, 1327, 1354):

       xform.ec.q.x.length = group->wx_len;
       xform.ec.pkey.length = priv_len;

Wycheproof encodes wx, wy and private as signed-style big integers:
in ecdsa_secp256r1_sha256_p1363_test.json most groups have a 33-byte wx or wy (leading 0x00), some 29 bytes; secp521r1 groups range 62-66; ecdh private lengths are 1, 29, 32, 33. QAT, which the README names for ECDSA/ECDH, packs with SET_PKE_LN/SET_PKE_9A_IN as buf + alignsize - length with no length check (drivers/crypto/qat/asym/qat_asym.c:81-96); a 33-byte value writes its 0x00 one byte before the slot, into the neighbouring operand. Result is wrong verifications, not skips. Normalize to bytesize:
strip leading zeros (value_equals_padded already does this), reject anything still longer than bytesize, left-pad into a fixed buffer. DSA p/q/g/y have the same encoding (a 2048-bit p is 257 bytes); only crypto_openssl implements DSA today so it is tolerated there.

4. IV copied into the op with no bound (lines 533, 538, 711):

memcpy(rte_crypto_op_ctod_offset(op, uint8_t *, IV_OFFSET),
vector->iv, vector->iv_len);

The only guard is the PMD's advertised iv_size range. mvsam advertises AES-GMAC iv_size max 65532 (rte_mrvl_pmd_ops.c:371); aes_gcm_test.json and aes_ccm_test.json carry 257 and 268-byte IVs. The room after IV_OFFSET is 152 bytes, and only because priv_size at line 210 is IV_OFFSET + 64: priv_size is already relative to the end of the sym op (rte_crypto_op_pool_create adds sizeof(op) + sizeof(sym_op)), so IV_OFFSET is counted twice. Define an IV maximum, use it as priv_size, and skip vectors whose iv_len (+1 for CCM) exceeds it.

5. mbuf pool sizing (line 181):

sizeof(struct rte_mbuf) + RTE_PKTMBUF_HEADROOM + env.mbuf_data_room

data_room_size already excludes the mbuf struct; this wastes 128 bytes per mbuf. The parameter is uint16_t and --mbuf-dataroom is only checked for != 0, so large values truncate silently and values below RTE_PKTMBUF_HEADROOM wrap the check at line 754 (env.mbuf_data_room - RTE_PKTMBUF_HEADROOM). Drop the sizeof and range-check the option.

6. PMD failures on valid vectors counted as skips (lines 1473-1476):

       } else {
           stats->skipped_capability++;
           debug_vector("SKIP", name, &vector, "PMD could not compute");

A valid ECDH vector where the op returns an error exits 0. run_ecdh_ecpoint and run_ecdsa_verify also turn asym session create failure into -ENOTSUP (lines 1341, 1556) while run_dsa_verify returns -ENOMEM and fails the vector. Capability skips should come only from the capability query; anything the PMD rejects after that is a failure for a validation tool.

7. Documentation and MAINTAINERS. Examples are documented in doc/guides/sample_app_ug/<name>.rst and listed in index.rst (see fips_validation); README.md is not the convention (only examples/bpf/README exists). Add the rst and a MAINTAINERS entry with F: examples/wycheproof_validation/ and the rst, as fips_validation has.

8. Makefile has no trailing newline (checkpatch warns).

Info
----

9. process_file is a 20-arm strcmp chain re-testing algorithm and schema in every arm. A static table {algorithm, schema, kind, algo id} and a loop replaces it.

10. decode_hex uses rte_malloc for every field. Only the AAD (the GCM/ChaCha path hands vector->aad to the PMD directly) and the digest buffers need IOVA memory; keys, messages, signatures and DSA/EC parameters are copied by the library or PMD. If the AAD is always copied into a 16-byte-padded rte_malloc buffer (fix 2 does this for CCM), decode_hex can use plain malloc.

11. Every dequeue loop (549, 637, 717, 1064, 1143, 1363, 1574) spins forever if the PMD never returns the op. A bounded wait that fails the vector is better for a tool meant to run on hardware.

12. Symbols used without a direct include: bool (<stdbool.h>), PRIu64 (<inttypes.h>), strtoul/EXIT_* (<stdlib.h>), PATH_MAX (<limits.h>). All come in transitively today.

13. Placement: this is a conformance tool with an exit-code contract, not a sample showing API use. app/ next to dpdk-test-crypto-perf is the more natural home.

14. Pre-existing, not introduced by this patch: QAT SET_PKE_LN and SET_PKE_9A_IN (qat_asym.c:81-96) never check length <= alignsize, so an oversize rte_crypto_uint writes before its slot. Worth a separate fix in the PMD.

Review-Result: ERROR

Add a Wycheproof JSON vector validation example for cryptodev PMDs.

Support these algorithms when advertised by the selected PMD:
- AEAD: AES-GCM, AES-CCM, SM4-GCM, ChaCha20-Poly1305
- MAC: AES-CMAC, AES-GMAC, HMAC SHA-1/SHA-2/SHA-3/SM3
- Asymmetric: DSA (P1363 verify), ECDSA (P1363 verify), ECDH (ecpoint shared-secret compute)

Validate valid vectors against generated ciphertexts, tags, plaintexts, digests, shared secrets, or signature verification, and require the expected rejection for invalid vectors. Digest inputs for DSA and ECDSA use the symmetric auth path, selecting a separate symmetric-capable device when the target device is asymmetric-only.

Skip parameter combinations outside PMD capability ranges and identify recognized vector families without a compatible DPDK transform. A --debug option lists every failed or skipped vector.

Add Meson and standalone build integration, with usage documentation.

---
 MAINTAINERS                                   |    5 +
 doc/guides/sample_app_ug/index.rst            |    1 +
 .../sample_app_ug/wycheproof_validation.rst   |   45 +
 examples/meson.build                          |    1 +
 examples/wycheproof_validation/Makefile       |   40 +
 examples/wycheproof_validation/main.c         | 1982 +++++++++++++++++
 examples/wycheproof_validation/meson.build    |   17 +
 7 files changed, 2091 insertions(+)
 create mode 100644 doc/guides/sample_app_ug/wycheproof_validation.rst
 create mode 100644 examples/wycheproof_validation/Makefile
 create mode 100644 examples/wycheproof_validation/main.c
 create mode 100644 examples/wycheproof_validation/meson.build

index e99a65d197..c20b037b6d 100644
@@ -2041,6 +2041,11 @@ M: Gowrishankar Muthukrishnan <[email protected]>
 F: examples/fips_validation/
 F: doc/guides/sample_app_ug/fips_validation.rst
 
+Wycheproof validation example
+M: Kai Ji <[email protected]>
+F: examples/wycheproof_validation/
+F: doc/guides/sample_app_ug/wycheproof_validation.rst
+
 Flow filtering example
 M: Ori Kam <[email protected]>
 F: examples/flow_filtering/

index f12623bb66..29313fe3de 100644
@@ -53,6 +53,7 @@ Sample Applications User Guides
     ptpclient
     ptp_tap_relay_sw
     fips_validation
+    wycheproof_validation
     ipsec_secgw
     bbdev_app
     ntb

index 25d9c88457..000d05863a 100644
@@ -59,6 +59,7 @@ all_examples = [
         'vm_power_manager/guest_cli',
         'vmdq',
         'vmdq_dcb',
+        'wycheproof_validation',
 ]
 
 # on install, skip copying all meson.build files

new file mode 100644
index 0000000000..8cc0293364
@@ -0,0 +1,40 @@
+# SPDX-License-Identifier: BSD-3-Clause
+# Copyright(c) 2026
+
+APP = wycheproof_validation
+SRCS-y := main.c
+
+PKGCONF ?= pkg-config
+
+ifneq ($(shell $(PKGCONF) --exists libdpdk && echo 0),0)
+$(error "no installation of DPDK found")
+endif
+ifneq ($(shell $(PKGCONF) --exists jansson && echo 0),0)
+$(error "Jansson is required")
+endif
+
+all: shared
+.PHONY: shared static
+shared: build/$(APP)-shared
+	ln -sf $(APP)-shared build/$(APP)
+static: build/$(APP)-static
+	ln -sf $(APP)-static build/$(APP)
+
+PC_FILE := $(shell $(PKGCONF) --path libdpdk 2>/dev/null)
+CFLAGS += -O3 $(shell $(PKGCONF) --cflags libdpdk jansson)
+LDFLAGS_SHARED = $(shell $(PKGCONF) --libs libdpdk jansson)
+LDFLAGS_STATIC = $(shell $(PKGCONF) --static --libs libdpdk jansson)
+
+build/$(APP)-shared: $(SRCS-y) Makefile $(PC_FILE) | build
+	$(CC) $(CFLAGS) $(SRCS-y) -o $@ $(LDFLAGS) $(LDFLAGS_SHARED)
+
+build/$(APP)-static: $(SRCS-y) Makefile $(PC_FILE) | build
+	$(CC) $(CFLAGS) $(SRCS-y) -o $@ $(LDFLAGS) $(LDFLAGS_STATIC)
+
+build:
+	@mkdir -p $@
+
+.PHONY: clean
+clean:
+	rm -f build/$(APP) build/$(APP)-static build/$(APP)-shared
+	test -d build && rmdir -p build || true

new file mode 100644
index 0000000000..7f18b4cef3
@@ -0,0 +1,17 @@
+# SPDX-License-Identifier: BSD-3-Clause
+# Copyright(c) 2026
+
+# meson file, for building this example as part of a main DPDK build.
+#
+# To build this example as a standalone application with an already-installed
+# DPDK instance, use 'make'
+
+deps += ['cryptodev']
+
+if not dpdk_conf.has('RTE_HAS_JANSSON')
+    build = false
+    message('Skipping wycheproof_validation: Jansson is required')
+else
+    ext_deps += jansson_dep
+    sources = files('main.c')
+endif

2.34.1

Except for few minor comments below, the patch looks good to me.

<CUT>

<CUT>

<CUT>

<CUT>

Wycheproof validation example (v3) - review

Applied on 6bbb7b3, built with -Dwerror=true, ran against crypto_openssl on 12 Wycheproof v1 files (GCM, CCM, ChaCha20-Poly1305, HMAC-SHA1/256, CMAC, GMAC, DSA, ECDSA, ECDH). No validation failures on supported vectors.

Errors
------

doc/guides/sample_app_ug/wycheproof_validation.rst:5
Title underline is 28 characters under a 29-character title:
Wycheproof Validation Example
============================
docutils reports "Title underline too short"; doc/guides/meson.build adds -W under -Dwerror, so the doc build fails. Add one '='.

Warnings
--------

main.c:790-792 validate_aead_vector()

    vector->msg_len > env.mbuf_data_room

Usable room in a fresh mbuf is data_room - RTE_PKTMBUF_HEADROOM. A message inside that 128-byte window passes this check, run_aead() returns -EMSGSIZE at line 536, and line 806 (ret != 0) counts it as a validation failure, so the exit status is nonzero. Verified:
--mbuf-dataroom 160 on aes_gcm_test.json gives failed=54, all ret=-90. run_hmac(), run_gmac() and compute_hash() have no pre-check at all and misclassify the same way (--mbuf-dataroom 128 on hmac_sha256_test.json: failed=110). Compare against env.mbuf_data_room - RTE_PKTMBUF_HEADROOM and map -EMSGSIZE to skipped_unsupported in every caller.

main.c:148-151 parse_args()

    if (parse_uint32(optarg, &value) != 0 ||
            !rte_cryptodev_is_valid_dev(value))
    env.dev_id = value;

rte_cryptodev_is_valid_dev() takes uint8_t; value is truncated before the validity check and again on assignment. Verified:
--cryptodev-id 256 silently runs on device 0 while --cryptodev-id 1 is correctly rejected. Reject value > UINT8_MAX (or

main.c:577-580 run_aead(), and the same pattern at 751, 1108, 1190, 1440, 1667

    completed = dequeue_one(env.dev_id);
    if (completed == NULL) {
        ret = -ETIMEDOUT;
        goto out;
    }

On timeout the op, mbuf, digest/aad buffers and session are freed at out: while the enqueued op is still owned by the PMD, then the tool moves on to the next vector. A hardware PMD (QAT is named as the target) completes into freed memory, and the next dequeue_one() can hand back the stale op as the current vector's result. Treat -ETIMEDOUT as fatal: propagate it to main() and stop, rather than free and continue.

Info
----

main.c:807-808, 817, 918, 998

    memcmp(output, vector->ct, vector->ct_len) != 0

When msg_len/ct_len is 0, run_aead() leaves *output NULL and decode_hex() leaves the vector buffer NULL, so this is memcmp(NULL, NULL, 0). Wycheproof has many empty-message vectors. glibc declares memcmp nonnull; -fsanitize=nonnull-attribute trips on it. Guard with len != 0 &&.

MAINTAINERS:2038
"Other Example Applications" is alphabetical; the new entry sits between FIPS and Flow filtering. Move it after "VMDq examples".

main.c:180

    struct rte_cryptodev_config config = { rte_socket_id(), 1, 0 };

Positional initializer; use .socket_id/.nb_queue_pairs/.ff_disable.

doc/guides/sample_app_ug/wycheproof_validation.rst
The documented crypto_openssl PMD advertises no ECDSA or ECDH xform capability (rte_openssl_pmd_ops.c capability table), so with the documented command line every ECDSA/ECDH vector lands in skipped_capability (verified: 0 passed, 241 skipped on ecdsa_secp256r1_sha256_p1363_test.json). Worth a sentence that asymmetric coverage needs a PMD advertising those xforms.

Review-Result: ERROR

Add a Wycheproof JSON vector validation example for cryptodev PMDs.

Support these algorithms when advertised by the selected PMD:
- AEAD: AES-GCM, AES-CCM, SM4-GCM, ChaCha20-Poly1305
- MAC: AES-CMAC, AES-GMAC, HMAC SHA-1/SHA-2/SHA-3/SM3
- Asymmetric: DSA (P1363 verify), ECDSA (P1363 verify), ECDH (ecpoint shared-secret compute)

Validate valid vectors against generated ciphertexts, tags, plaintexts, digests, shared secrets, or signature verification, and require the expected rejection for invalid vectors. Digest inputs for DSA and ECDSA use the symmetric auth path, selecting a separate symmetric-capable device when the target device is asymmetric-only.

Skip parameter combinations outside PMD capability ranges and identify recognized vector families without a compatible DPDK transform. A --debug option lists every failed or skipped vector.

Add Meson and standalone build integration, with usage documentation.

---
 MAINTAINERS                                   |    5 +
 doc/guides/rel_notes/release_26_11.rst        |    6 +
 doc/guides/sample_app_ug/index.rst            |    1 +
 .../sample_app_ug/wycheproof_validation.rst   |   45 +
 examples/meson.build                          |    1 +
 examples/wycheproof_validation/Makefile       |   40 +
 examples/wycheproof_validation/main.c         | 2051 +++++++++++++++++
 examples/wycheproof_validation/meson.build    |   17 +
 8 files changed, 2166 insertions(+)
 create mode 100644 doc/guides/sample_app_ug/wycheproof_validation.rst
 create mode 100644 examples/wycheproof_validation/Makefile
 create mode 100644 examples/wycheproof_validation/main.c
 create mode 100644 examples/wycheproof_validation/meson.build

index 8c50c52933..d33923cbb2 100644
@@ -2106,3 +2106,8 @@ F: examples/vmdq/
 F: doc/guides/sample_app_ug/vmdq_forwarding.rst
 F: examples/vmdq_dcb/
 F: doc/guides/sample_app_ug/vmdq_dcb_forwarding.rst
+
+Wycheproof validation example
+M: Kai Ji <[email protected]>
+F: examples/wycheproof_validation/
+F: doc/guides/sample_app_ug/wycheproof_validation.rst

index 4b3e5d995c..0126d25a58 100644
@@ -55,6 +55,12 @@ New Features
      Also, make sure to start the actual text at the margin.
      =======================================================
 
+* **Added Wycheproof validation example application.**
+
+  Added a new example application that validates a DPDK cryptodev PMD against
+  the Google Wycheproof JSON test vectors, covering AEAD, MAC, DSA, ECDH and
+  ECDSA algorithm families.
+
 
 Removed Items
 -------------

index f12623bb66..29313fe3de 100644
@@ -53,6 +53,7 @@ Sample Applications User Guides
     ptpclient
     ptp_tap_relay_sw
     fips_validation
+    wycheproof_validation
     ipsec_secgw
     bbdev_app
     ntb

index 25d9c88457..000d05863a 100644
@@ -59,6 +59,7 @@ all_examples = [
         'vm_power_manager/guest_cli',
         'vmdq',
         'vmdq_dcb',
+        'wycheproof_validation',
 ]
 
 # on install, skip copying all meson.build files

new file mode 100644
index 0000000000..8cc0293364
@@ -0,0 +1,40 @@
+# SPDX-License-Identifier: BSD-3-Clause
+# Copyright(c) 2026
+
+APP = wycheproof_validation
+SRCS-y := main.c
+
+PKGCONF ?= pkg-config
+
+ifneq ($(shell $(PKGCONF) --exists libdpdk && echo 0),0)
+$(error "no installation of DPDK found")
+endif
+ifneq ($(shell $(PKGCONF) --exists jansson && echo 0),0)
+$(error "Jansson is required")
+endif
+
+all: shared
+.PHONY: shared static
+shared: build/$(APP)-shared
+	ln -sf $(APP)-shared build/$(APP)
+static: build/$(APP)-static
+	ln -sf $(APP)-static build/$(APP)
+
+PC_FILE := $(shell $(PKGCONF) --path libdpdk 2>/dev/null)
+CFLAGS += -O3 $(shell $(PKGCONF) --cflags libdpdk jansson)
+LDFLAGS_SHARED = $(shell $(PKGCONF) --libs libdpdk jansson)
+LDFLAGS_STATIC = $(shell $(PKGCONF) --static --libs libdpdk jansson)
+
+build/$(APP)-shared: $(SRCS-y) Makefile $(PC_FILE) | build
+	$(CC) $(CFLAGS) $(SRCS-y) -o $@ $(LDFLAGS) $(LDFLAGS_SHARED)
+
+build/$(APP)-static: $(SRCS-y) Makefile $(PC_FILE) | build
+	$(CC) $(CFLAGS) $(SRCS-y) -o $@ $(LDFLAGS) $(LDFLAGS_STATIC)
+
+build:
+	@mkdir -p $@
+
+.PHONY: clean
+clean:
+	rm -f build/$(APP) build/$(APP)-static build/$(APP)-shared
+	test -d build && rmdir -p build || true

new file mode 100644
index 0000000000..7f18b4cef3
@@ -0,0 +1,17 @@
+# SPDX-License-Identifier: BSD-3-Clause
+# Copyright(c) 2026
+
+# meson file, for building this example as part of a main DPDK build.
+#
+# To build this example as a standalone application with an already-installed
+# DPDK instance, use 'make'
+
+deps += ['cryptodev']
+
+if not dpdk_conf.has('RTE_HAS_JANSSON')
+    build = false
+    message('Skipping wycheproof_validation: Jansson is required')
+else
+    ext_deps += jansson_dep
+    sources = files('main.c')
+endif

2.34.1

Add a Wycheproof JSON vector validation example for cryptodev PMDs.

Support these algorithms when advertised by the selected PMD:
- AEAD: AES-GCM, AES-CCM, SM4-GCM, ChaCha20-Poly1305
- MAC: AES-CMAC, AES-GMAC, HMAC SHA-1/SHA-2/SHA-3/SM3
- Asymmetric: DSA (P1363 verify), ECDSA (P1363 verify), ECDH (ecpoint shared-secret compute)

Validate valid vectors against generated ciphertexts, tags, plaintexts, digests, shared secrets, or signature verification, and require the expected rejection for invalid vectors. Digest inputs for DSA and ECDSA use the symmetric auth path, selecting a separate symmetric-capable device when the target device is asymmetric-only.

Skip parameter combinations outside PMD capability ranges and identify recognized vector families without a compatible DPDK transform. A --debug option lists every failed or skipped vector.

Add Meson and standalone build integration, with usage documentation.

---
 MAINTAINERS                                   |    5 +
 doc/guides/rel_notes/release_26_11.rst        |    6 +
 doc/guides/sample_app_ug/index.rst            |    1 +
 .../sample_app_ug/wycheproof_validation.rst   |   45 +
 examples/meson.build                          |    1 +
 examples/wycheproof_validation/Makefile       |   40 +
 examples/wycheproof_validation/main.c         | 2060 +++++++++++++++++
 examples/wycheproof_validation/meson.build    |   17 +
 8 files changed, 2175 insertions(+)
 create mode 100644 doc/guides/sample_app_ug/wycheproof_validation.rst
 create mode 100644 examples/wycheproof_validation/Makefile
 create mode 100644 examples/wycheproof_validation/main.c
 create mode 100644 examples/wycheproof_validation/meson.build

index 8c50c52933..d33923cbb2 100644
@@ -2106,3 +2106,8 @@ F: examples/vmdq/
 F: doc/guides/sample_app_ug/vmdq_forwarding.rst
 F: examples/vmdq_dcb/
 F: doc/guides/sample_app_ug/vmdq_dcb_forwarding.rst
+
+Wycheproof validation example
+M: Kai Ji <[email protected]>
+F: examples/wycheproof_validation/
+F: doc/guides/sample_app_ug/wycheproof_validation.rst

index 4b3e5d995c..0126d25a58 100644
@@ -55,6 +55,12 @@ New Features
      Also, make sure to start the actual text at the margin.
      =======================================================
 
+* **Added Wycheproof validation example application.**
+
+  Added a new example application that validates a DPDK cryptodev PMD against
+  the Google Wycheproof JSON test vectors, covering AEAD, MAC, DSA, ECDH and
+  ECDSA algorithm families.
+
 
 Removed Items
 -------------

index f12623bb66..29313fe3de 100644
@@ -53,6 +53,7 @@ Sample Applications User Guides
     ptpclient
     ptp_tap_relay_sw
     fips_validation
+    wycheproof_validation
     ipsec_secgw
     bbdev_app
     ntb

index 25d9c88457..000d05863a 100644
@@ -59,6 +59,7 @@ all_examples = [
         'vm_power_manager/guest_cli',
         'vmdq',
         'vmdq_dcb',
+        'wycheproof_validation',
 ]
 
 # on install, skip copying all meson.build files

new file mode 100644
index 0000000000..8cc0293364
@@ -0,0 +1,40 @@
+# SPDX-License-Identifier: BSD-3-Clause
+# Copyright(c) 2026
+
+APP = wycheproof_validation
+SRCS-y := main.c
+
+PKGCONF ?= pkg-config
+
+ifneq ($(shell $(PKGCONF) --exists libdpdk && echo 0),0)
+$(error "no installation of DPDK found")
+endif
+ifneq ($(shell $(PKGCONF) --exists jansson && echo 0),0)
+$(error "Jansson is required")
+endif
+
+all: shared
+.PHONY: shared static
+shared: build/$(APP)-shared
+	ln -sf $(APP)-shared build/$(APP)
+static: build/$(APP)-static
+	ln -sf $(APP)-static build/$(APP)
+
+PC_FILE := $(shell $(PKGCONF) --path libdpdk 2>/dev/null)
+CFLAGS += -O3 $(shell $(PKGCONF) --cflags libdpdk jansson)
+LDFLAGS_SHARED = $(shell $(PKGCONF) --libs libdpdk jansson)
+LDFLAGS_STATIC = $(shell $(PKGCONF) --static --libs libdpdk jansson)
+
+build/$(APP)-shared: $(SRCS-y) Makefile $(PC_FILE) | build
+	$(CC) $(CFLAGS) $(SRCS-y) -o $@ $(LDFLAGS) $(LDFLAGS_SHARED)
+
+build/$(APP)-static: $(SRCS-y) Makefile $(PC_FILE) | build
+	$(CC) $(CFLAGS) $(SRCS-y) -o $@ $(LDFLAGS) $(LDFLAGS_STATIC)
+
+build:
+	@mkdir -p $@
+
+.PHONY: clean
+clean:
+	rm -f build/$(APP) build/$(APP)-static build/$(APP)-shared
+	test -d build && rmdir -p build || true

new file mode 100644
index 0000000000..7f18b4cef3
@@ -0,0 +1,17 @@
+# SPDX-License-Identifier: BSD-3-Clause
+# Copyright(c) 2026
+
+# meson file, for building this example as part of a main DPDK build.
+#
+# To build this example as a standalone application with an already-installed
+# DPDK instance, use 'make'
+
+deps += ['cryptodev']
+
+if not dpdk_conf.has('RTE_HAS_JANSSON')
+    build = false
+    message('Skipping wycheproof_validation: Jansson is required')
+else
+    ext_deps += jansson_dep
+    sources = files('main.c')
+endif

2.34.1

AI review had some useful suggestions on this.

Wycheproof validation example (v5) - review

v4 -> v5 delta: drop unused APP_NAME, close the device on the app_init() error path, and treat asym session-create failure as -ENOTSUP (skip) instead of -EIO/-ENOMEM (fail) in run_dsa_verify(), run_ecdh_ecpoint() and run_ecdsa_verify().

Applied on 6bbb7b3, built with -Dwerror=true, docutils clean. Same crypto_openssl runs as v4: directory run passed=1902 failed=0, --mbuf-dataroom 160 and --cryptodev-id 256 behave as in v4.

No Errors or Warnings.

Info
----

main.c:1222, 1480, 1715

    ret = -ENOTSUP;

Session-create failure is now indistinguishable from an unsupported curve or key size: a PMD that advertises the xform but fails session setup for a curve it claims to support, or a -ENOMEM from an exhausted asym session pool, lands in skipped_capability and the exit status stays zero. Understood that the asym capability struct does not enumerate curves, so this is a documented trade-off; just noting that valid asym vectors can no longer fail at session setup.

main.c:823-824, 837, 957, 1047 (open since v3)

    memcmp(output, vector->ct, vector->ct_len) != 0

memcmp(NULL, NULL, 0) for empty-message vectors; glibc declares memcmp nonnull. Guard with len != 0 &&.

main.c:182-183, 266 (open since v3)
Positional struct initializers; use designated members.

doc/guides/sample_app_ug/wycheproof_validation.rst (open since v3)
crypto_openssl advertises no ECDSA/ECDH xform capability, so the documented command line skips every ECDSA/ECDH vector. One sentence saying asymmetric coverage needs a PMD advertising those xforms.

Pre-existing, not introduced by this patch
lib/cryptodev/rte_cryptodev.c:2411 rte_cryptodev_asym_session_create()

    ret = dev->dev_ops->asym_session_configure(dev, xforms, sess);
    if (ret < 0) {
        ...
        return ret;
    }

On configure failure the object stays allocated from the pool and *session still points at it, unlike the sym variant which does rte_mempool_put() on its error_exit path. This app copes by freeing a non-NULL session at out: even when create returned an error; if the library is ever aligned with the sym behaviour that becomes a double put. One for the cryptodev maintainers, not this patch.

Review-Result: CLEAN

Add a Wycheproof JSON vector validation example for cryptodev PMDs.

Support these algorithms when advertised by the selected PMD:
- AEAD: AES-GCM, AES-CCM, SM4-GCM, ChaCha20-Poly1305
- MAC: AES-CMAC, AES-GMAC, HMAC SHA-1/SHA-2/SHA-3/SM3
- Asymmetric: DSA (P1363 verify), ECDSA (P1363 verify), ECDH (ecpoint shared-secret compute)

Validate valid vectors against generated ciphertexts, tags, plaintexts, digests, shared secrets, or signature verification, and require the expected rejection for invalid vectors. Digest inputs for DSA and ECDSA use the symmetric auth path, selecting a separate symmetric-capable device when the target device is asymmetric-only.

Skip parameter combinations outside PMD capability ranges and identify recognized vector families without a compatible DPDK transform. A --debug option lists every failed or skipped vector.

Add Meson and standalone build integration, with usage documentation.

---
 MAINTAINERS                                   |    5 +
 doc/guides/rel_notes/release_26_11.rst        |    6 +
 doc/guides/sample_app_ug/index.rst            |    1 +
 .../sample_app_ug/wycheproof_validation.rst   |   50 +
 examples/meson.build                          |    1 +
 examples/wycheproof_validation/Makefile       |   40 +
 examples/wycheproof_validation/main.c         | 2090 +++++++++++++++++
 examples/wycheproof_validation/meson.build    |   17 +
 8 files changed, 2210 insertions(+)
 create mode 100644 doc/guides/sample_app_ug/wycheproof_validation.rst
 create mode 100644 examples/wycheproof_validation/Makefile
 create mode 100644 examples/wycheproof_validation/main.c
 create mode 100644 examples/wycheproof_validation/meson.build

index 8c50c52933..d33923cbb2 100644
@@ -2106,3 +2106,8 @@ F: examples/vmdq/
 F: doc/guides/sample_app_ug/vmdq_forwarding.rst
 F: examples/vmdq_dcb/
 F: doc/guides/sample_app_ug/vmdq_dcb_forwarding.rst
+
+Wycheproof validation example
+M: Kai Ji <[email protected]>
+F: examples/wycheproof_validation/
+F: doc/guides/sample_app_ug/wycheproof_validation.rst

index 4b3e5d995c..0126d25a58 100644
@@ -55,6 +55,12 @@ New Features
      Also, make sure to start the actual text at the margin.
      =======================================================
 
+* **Added Wycheproof validation example application.**
+
+  Added a new example application that validates a DPDK cryptodev PMD against
+  the Google Wycheproof JSON test vectors, covering AEAD, MAC, DSA, ECDH and
+  ECDSA algorithm families.
+
 
 Removed Items
 -------------

index f12623bb66..29313fe3de 100644
@@ -53,6 +53,7 @@ Sample Applications User Guides
     ptpclient
     ptp_tap_relay_sw
     fips_validation
+    wycheproof_validation
     ipsec_secgw
     bbdev_app
     ntb

index 25d9c88457..000d05863a 100644
@@ -59,6 +59,7 @@ all_examples = [
         'vm_power_manager/guest_cli',
         'vmdq',
         'vmdq_dcb',
+        'wycheproof_validation',
 ]
 
 # on install, skip copying all meson.build files

new file mode 100644
index 0000000000..8cc0293364
@@ -0,0 +1,40 @@
+# SPDX-License-Identifier: BSD-3-Clause
+# Copyright(c) 2026
+
+APP = wycheproof_validation
+SRCS-y := main.c
+
+PKGCONF ?= pkg-config
+
+ifneq ($(shell $(PKGCONF) --exists libdpdk && echo 0),0)
+$(error "no installation of DPDK found")
+endif
+ifneq ($(shell $(PKGCONF) --exists jansson && echo 0),0)
+$(error "Jansson is required")
+endif
+
+all: shared
+.PHONY: shared static
+shared: build/$(APP)-shared
+	ln -sf $(APP)-shared build/$(APP)
+static: build/$(APP)-static
+	ln -sf $(APP)-static build/$(APP)
+
+PC_FILE := $(shell $(PKGCONF) --path libdpdk 2>/dev/null)
+CFLAGS += -O3 $(shell $(PKGCONF) --cflags libdpdk jansson)
+LDFLAGS_SHARED = $(shell $(PKGCONF) --libs libdpdk jansson)
+LDFLAGS_STATIC = $(shell $(PKGCONF) --static --libs libdpdk jansson)
+
+build/$(APP)-shared: $(SRCS-y) Makefile $(PC_FILE) | build
+	$(CC) $(CFLAGS) $(SRCS-y) -o $@ $(LDFLAGS) $(LDFLAGS_SHARED)
+
+build/$(APP)-static: $(SRCS-y) Makefile $(PC_FILE) | build
+	$(CC) $(CFLAGS) $(SRCS-y) -o $@ $(LDFLAGS) $(LDFLAGS_STATIC)
+
+build:
+	@mkdir -p $@
+
+.PHONY: clean
+clean:
+	rm -f build/$(APP) build/$(APP)-static build/$(APP)-shared
+	test -d build && rmdir -p build || true

new file mode 100644
index 0000000000..7f18b4cef3
@@ -0,0 +1,17 @@
+# SPDX-License-Identifier: BSD-3-Clause
+# Copyright(c) 2026
+
+# meson file, for building this example as part of a main DPDK build.
+#
+# To build this example as a standalone application with an already-installed
+# DPDK instance, use 'make'
+
+deps += ['cryptodev']
+
+if not dpdk_conf.has('RTE_HAS_JANSSON')
+    build = false
+    message('Skipping wycheproof_validation: Jansson is required')
+else
+    ext_deps += jansson_dep
+    sources = files('main.c')
+endif

2.34.1

Add a Wycheproof JSON vector validation example for cryptodev PMDs.

Support these algorithms when advertised by the selected PMD:
- AEAD: AES-GCM, AES-CCM, SM4-GCM, ChaCha20-Poly1305
- MAC: AES-CMAC, AES-GMAC, HMAC SHA-1/SHA-2/SHA-3/SM3
- Asymmetric: DSA (P1363 verify), ECDSA (P1363 verify), ECDH (ecpoint shared-secret compute)

Validate valid vectors against generated ciphertexts, tags, plaintexts, digests, shared secrets, or signature verification, and require the expected rejection for invalid vectors. Digest inputs for DSA and ECDSA use the symmetric auth path, selecting a separate symmetric-capable device when the target device is asymmetric-only.

Skip parameter combinations outside PMD capability ranges and identify recognized vector families without a compatible DPDK transform. A --debug option lists every failed or skipped vector.

Add Meson and standalone build integration, with usage documentation.

---
 MAINTAINERS                                   |    5 +
 doc/guides/rel_notes/release_26_11.rst        |    6 +
 doc/guides/sample_app_ug/index.rst            |    1 +
 .../sample_app_ug/wycheproof_validation.rst   |   50 +
 examples/meson.build                          |    1 +
 examples/wycheproof_validation/Makefile       |   40 +
 examples/wycheproof_validation/main.c         | 2090 +++++++++++++++++
 examples/wycheproof_validation/meson.build    |   17 +
 8 files changed, 2210 insertions(+)
 create mode 100644 doc/guides/sample_app_ug/wycheproof_validation.rst
 create mode 100644 examples/wycheproof_validation/Makefile
 create mode 100644 examples/wycheproof_validation/main.c
 create mode 100644 examples/wycheproof_validation/meson.build

index 186cc82b39..580e2c2591 100644
@@ -2099,3 +2099,8 @@ F: examples/vmdq/
 F: doc/guides/sample_app_ug/vmdq_forwarding.rst
 F: examples/vmdq_dcb/
 F: doc/guides/sample_app_ug/vmdq_dcb_forwarding.rst
+
+Wycheproof validation example
+M: Kai Ji <[email protected]>
+F: examples/wycheproof_validation/
+F: doc/guides/sample_app_ug/wycheproof_validation.rst

index dec96ccbc7..cd2711ddad 100644
@@ -133,6 +133,12 @@ New Features
     with per-descriptor mbuf free (``rte_pktmbuf_free_seg``) and prefetch hints.
   * Changed the set of per-queue xstats counters.
 
+* **Added Wycheproof validation example application.**
+
+  Added a new example application that validates a DPDK cryptodev PMD against
+  the Google Wycheproof JSON test vectors, covering AEAD, MAC, DSA, ECDH and
+  ECDSA algorithm families.
+
 
 Removed Items
 -------------

index 28c4c9a5b2..2458b06ccd 100644
@@ -51,6 +51,7 @@ Sample Applications User Guides
     ptpclient
     ptp_tap_relay_sw
     fips_validation
+    wycheproof_validation
     ipsec_secgw
     bbdev_app
     ntb

index 544ec5eadd..156efe447f 100644
@@ -58,6 +58,7 @@ all_examples = [
         'vm_power_manager/guest_cli',
         'vmdq',
         'vmdq_dcb',
+        'wycheproof_validation',
 ]
 
 # on install, skip copying all meson.build files

new file mode 100644
index 0000000000..8cc0293364
@@ -0,0 +1,40 @@
+# SPDX-License-Identifier: BSD-3-Clause
+# Copyright(c) 2026
+
+APP = wycheproof_validation
+SRCS-y := main.c
+
+PKGCONF ?= pkg-config
+
+ifneq ($(shell $(PKGCONF) --exists libdpdk && echo 0),0)
+$(error "no installation of DPDK found")
+endif
+ifneq ($(shell $(PKGCONF) --exists jansson && echo 0),0)
+$(error "Jansson is required")
+endif
+
+all: shared
+.PHONY: shared static
+shared: build/$(APP)-shared
+	ln -sf $(APP)-shared build/$(APP)
+static: build/$(APP)-static
+	ln -sf $(APP)-static build/$(APP)
+
+PC_FILE := $(shell $(PKGCONF) --path libdpdk 2>/dev/null)
+CFLAGS += -O3 $(shell $(PKGCONF) --cflags libdpdk jansson)
+LDFLAGS_SHARED = $(shell $(PKGCONF) --libs libdpdk jansson)
+LDFLAGS_STATIC = $(shell $(PKGCONF) --static --libs libdpdk jansson)
+
+build/$(APP)-shared: $(SRCS-y) Makefile $(PC_FILE) | build
+	$(CC) $(CFLAGS) $(SRCS-y) -o $@ $(LDFLAGS) $(LDFLAGS_SHARED)
+
+build/$(APP)-static: $(SRCS-y) Makefile $(PC_FILE) | build
+	$(CC) $(CFLAGS) $(SRCS-y) -o $@ $(LDFLAGS) $(LDFLAGS_STATIC)
+
+build:
+	@mkdir -p $@
+
+.PHONY: clean
+clean:
+	rm -f build/$(APP) build/$(APP)-static build/$(APP)-shared
+	test -d build && rmdir -p build || true

new file mode 100644
index 0000000000..7f18b4cef3
@@ -0,0 +1,17 @@
+# SPDX-License-Identifier: BSD-3-Clause
+# Copyright(c) 2026
+
+# meson file, for building this example as part of a main DPDK build.
+#
+# To build this example as a standalone application with an already-installed
+# DPDK instance, use 'make'
+
+deps += ['cryptodev']
+
+if not dpdk_conf.has('RTE_HAS_JANSSON')
+    build = false
+    message('Skipping wycheproof_validation: Jansson is required')
+else
+    ext_deps += jansson_dep
+    sources = files('main.c')
+endif

2.34.1

Wycheproof differs somewhat from the existing cryptodev test vectors in that it is an externally maintained collection of JSON test suites covering a large number of edge cases and negative tests. The intended usage model is to load the upstream vector files at runtime rather than embedding them in the DPDK tree. I think the existing examples/fips_validation application follows a similar approach, consuming external CAVP/ACVP vector files rather than integrating them into dpdk-test. This patch follows that precedent, with the goal of providing file-driven conformance validation as a standalone example application. I agree that the documentation can be improved. At minimum, the .rst should describe where the Wycheproof vectors can be obtained and reference the applicable upstream license, as the current example command may give the impression that the vector files are included in the DPDK source tree when they are not. Regards

Kai

________________________________
From: Akhil Goyal <[email protected]>
Sent: Thursday, September 24, 2026 15:35
To: Ji, Kai <[email protected]>; [email protected] <[email protected]>
Cc: Thomas Monjalon <[email protected]>
Subject: RE: [EXTERNAL] [PATCH v7] examples: add Wycheproof validation app

Ok, so in that case did you consider integrating this app into fips_validation app.. May be we could rename fips_validation to crypto_validation and internally have 2 modes - Fips and Wycheproof? Like what we have for examples/multi_process?

24/09/2026 20:00, Akhil Goyal:

I like this proposal.

I agree that a single validation framework would make cryptodev validation easier to discover, document, and maintain, and could eventually allow some common setup and reporting infrastructure to be shared.
That said, the overlap between the two applications is primarily at the cryptodev API level. Their core purposes are quite different. The FIPS validation application is focused on CAVP/ACVP workflows, including request/response processing and conformance testing, whereas Wycheproof is built around externally maintained JSON test suites with valid/invalid/acceptable result classifications and different requirements for asymmetric devices. While there may be opportunities for code reuse in the future, merging them today would likely introduce additional dispatcher and lifecycle complexity with limited immediate benefit. It could also blur the distinction between Wycheproof robustness testing and FIPS conformance validation.
My preference would be to keep them as separate applications for now and revisit consolidation if we identify a meaningful amount of shared infrastructure.
Regards,

Kai

________________________________
From: Thomas Monjalon <[email protected]>
Sent: Friday, September 25, 2026 17:32
To: Ji, Kai <[email protected]>; Akhil Goyal <[email protected]>
Cc: [email protected] <[email protected]>
Subject: Re: [EXTERNAL] [PATCH v7] examples: add Wycheproof validation app

24/09/2026 20:00, Akhil Goyal:

I like this proposal.

The idea is not about code reuse.. But it is to limit the number of example applications. For crypto validation we already have fips_validation as well as dpdk-test.
If we move this new app under a folder examples/crypto_validation along with fips_validation, it will make more sense like multi_process example.

We cannot just keep on adding new examples for every new way of crypto validation.

Add a Wycheproof JSON vector validation example for cryptodev PMDs.

Group crypto validation applications under examples/crypto_validation, alongside the existing FIPS validation example, to keep the example tree organized by purpose.

Support AEAD, MAC, DSA, ECDH and ECDSA vector families when advertised by the selected PMD. Validate expected outputs and rejection behavior, and report unsupported or capability-skipped vectors separately.

---

 26 files changed, 2213 insertions(+), 2 deletions(-)

index 482bc7df76..7a2ad7849a 100644
@@ -2026,7 +2026,7 @@ F: doc/guides/sample_app_ug/ethtool.rst
 
 FIPS validation example
 M: Gowrishankar Muthukrishnan <[email protected]>
-F: examples/fips_validation/
+F: examples/crypto_validation/fips_validation/
 F: doc/guides/sample_app_ug/fips_validation.rst
 
 Flow filtering example

@@ -2100,3 +2100,8 @@ F: examples/vmdq/
 F: doc/guides/sample_app_ug/vmdq_forwarding.rst
 F: examples/vmdq_dcb/
 F: doc/guides/sample_app_ug/vmdq_dcb_forwarding.rst
+
+Wycheproof validation example
+M: Kai Ji <[email protected]>
+F: examples/crypto_validation/wycheproof_validation/
+F: doc/guides/sample_app_ug/wycheproof_validation.rst

index 28c4c9a5b2..2458b06ccd 100644
@@ -51,6 +51,7 @@ Sample Applications User Guides
     ptpclient
     ptp_tap_relay_sw
     fips_validation
+    wycheproof_validation
     ipsec_secgw
     bbdev_app
     ntb

similarity index 100%
rename from examples/fips_validation/Makefile
rename to examples/crypto_validation/fips_validation/Makefile

similarity index 100%
rename from examples/fips_validation/fips_dev_self_test.c
rename to examples/crypto_validation/fips_validation/fips_dev_self_test.c

similarity index 100%
rename from examples/fips_validation/fips_dev_self_test.h
rename to examples/crypto_validation/fips_validation/fips_dev_self_test.h

similarity index 100%
rename from examples/fips_validation/fips_validation.c
rename to examples/crypto_validation/fips_validation/fips_validation.c

similarity index 100%
rename from examples/fips_validation/fips_validation.h
rename to examples/crypto_validation/fips_validation/fips_validation.h

similarity index 100%
rename from examples/fips_validation/fips_validation_aes.c
rename to examples/crypto_validation/fips_validation/fips_validation_aes.c

similarity index 100%
rename from examples/fips_validation/fips_validation_ccm.c
rename to examples/crypto_validation/fips_validation/fips_validation_ccm.c

similarity index 100%
rename from examples/fips_validation/fips_validation_cmac.c
rename to examples/crypto_validation/fips_validation/fips_validation_cmac.c

similarity index 100%
rename from examples/fips_validation/fips_validation_ecdsa.c
rename to examples/crypto_validation/fips_validation/fips_validation_ecdsa.c

similarity index 100%
rename from examples/fips_validation/fips_validation_eddsa.c
rename to examples/crypto_validation/fips_validation/fips_validation_eddsa.c

similarity index 100%
rename from examples/fips_validation/fips_validation_gcm.c
rename to examples/crypto_validation/fips_validation/fips_validation_gcm.c

similarity index 100%
rename from examples/fips_validation/fips_validation_hmac.c
rename to examples/crypto_validation/fips_validation/fips_validation_hmac.c

similarity index 100%
rename from examples/fips_validation/fips_validation_rsa.c
rename to examples/crypto_validation/fips_validation/fips_validation_rsa.c

similarity index 100%
rename from examples/fips_validation/fips_validation_sha.c
rename to examples/crypto_validation/fips_validation/fips_validation_sha.c

similarity index 100%
rename from examples/fips_validation/fips_validation_tdes.c
rename to examples/crypto_validation/fips_validation/fips_validation_tdes.c

similarity index 100%
rename from examples/fips_validation/fips_validation_xts.c
rename to examples/crypto_validation/fips_validation/fips_validation_xts.c

similarity index 100%
rename from examples/fips_validation/main.c
rename to examples/crypto_validation/fips_validation/main.c

similarity index 100%
rename from examples/fips_validation/meson.build
rename to examples/crypto_validation/fips_validation/meson.build

new file mode 100644
index 0000000000..8cc0293364
@@ -0,0 +1,40 @@
+# SPDX-License-Identifier: BSD-3-Clause
+# Copyright(c) 2026
+
+APP = wycheproof_validation
+SRCS-y := main.c
+
+PKGCONF ?= pkg-config
+
+ifneq ($(shell $(PKGCONF) --exists libdpdk && echo 0),0)
+$(error "no installation of DPDK found")
+endif
+ifneq ($(shell $(PKGCONF) --exists jansson && echo 0),0)
+$(error "Jansson is required")
+endif
+
+all: shared
+.PHONY: shared static
+shared: build/$(APP)-shared
+	ln -sf $(APP)-shared build/$(APP)
+static: build/$(APP)-static
+	ln -sf $(APP)-static build/$(APP)
+
+PC_FILE := $(shell $(PKGCONF) --path libdpdk 2>/dev/null)
+CFLAGS += -O3 $(shell $(PKGCONF) --cflags libdpdk jansson)
+LDFLAGS_SHARED = $(shell $(PKGCONF) --libs libdpdk jansson)
+LDFLAGS_STATIC = $(shell $(PKGCONF) --static --libs libdpdk jansson)
+
+build/$(APP)-shared: $(SRCS-y) Makefile $(PC_FILE) | build
+	$(CC) $(CFLAGS) $(SRCS-y) -o $@ $(LDFLAGS) $(LDFLAGS_SHARED)
+
+build/$(APP)-static: $(SRCS-y) Makefile $(PC_FILE) | build
+	$(CC) $(CFLAGS) $(SRCS-y) -o $@ $(LDFLAGS) $(LDFLAGS_STATIC)
+
+build:
+	@mkdir -p $@
+
+.PHONY: clean
+clean:
+	rm -f build/$(APP) build/$(APP)-static build/$(APP)-shared
+	test -d build && rmdir -p build || true

new file mode 100644
index 0000000000..7f18b4cef3
@@ -0,0 +1,17 @@
+# SPDX-License-Identifier: BSD-3-Clause
+# Copyright(c) 2026
+
+# meson file, for building this example as part of a main DPDK build.
+#
+# To build this example as a standalone application with an already-installed
+# DPDK instance, use 'make'
+
+deps += ['cryptodev']
+
+if not dpdk_conf.has('RTE_HAS_JANSSON')
+    build = false
+    message('Skipping wycheproof_validation: Jansson is required')
+else
+    ext_deps += jansson_dep
+    sources = files('main.c')
+endif

index 544ec5eadd..2c4bc6cbe0 100644
@@ -11,11 +11,12 @@ all_examples = [
         'bbdev_app',
         'bond',
         'cmdline',
+        'crypto_validation/fips_validation',
+        'crypto_validation/wycheproof_validation',
         'distributor',
         'dma',
         'ethtool',
         'eventdev_pipeline',
-        'fips_validation',
         'flow_filtering',
         'helloworld',
         'ip_fragmentation',

@@ -155,1 +155,7 @@
+* **Added Wycheproof validation example application.**
+
+  Added a new example application that validates a DPDK cryptodev PMD against
+  the Google Wycheproof JSON test vectors, covering AEAD, MAC, DSA, ECDH and
+  ECDSA algorithm families.
+
 Removed Items

--
2.34.1

Add a Wycheproof JSON vector validation example for cryptodev PMDs.

Create examples/crypto_validation for the validation applications. Move the existing examples/fips_validation application into that directory alongside Wycheproof.

Support these algorithms when advertised by the selected PMD:
- AEAD: AES-GCM, AES-CCM, SM4-GCM, ChaCha20-Poly1305
- MAC: AES-CMAC, AES-GMAC, HMAC SHA-1/SHA-2/SHA-3/SM3
- Asymmetric: DSA (P1363 verify), ECDSA (P1363 verify), ECDH (ecpoint shared-secret compute)

Validate valid vectors against generated ciphertexts, tags, plaintexts, digests, shared secrets, or signature verification, and require the expected rejection for invalid vectors. Digest inputs for DSA and ECDSA use the symmetric auth path, selecting a separate symmetric-capable device when the target device is asymmetric-only.

Skip parameter combinations outside PMD capability ranges and identify recognized vector families without a compatible DPDK transform. A --debug option lists every failed or skipped vector.

Add Meson and standalone build integration, with usage documentation.

---
 MAINTAINERS                                   |    7 +-
 doc/guides/rel_notes/release_26_11.rst        |    6 +
 doc/guides/sample_app_ug/index.rst            |    1 +
 .../sample_app_ug/wycheproof_validation.rst   |   51 +
 .../fips_validation/Makefile                  |    0
 .../fips_validation/fips_dev_self_test.c      |    0
 .../fips_validation/fips_dev_self_test.h      |    0
 .../fips_validation/fips_validation.c         |    0
 .../fips_validation/fips_validation.h         |    0
 .../fips_validation/fips_validation_aes.c     |    0
 .../fips_validation/fips_validation_ccm.c     |    0
 .../fips_validation/fips_validation_cmac.c    |    0
 .../fips_validation/fips_validation_ecdsa.c   |    0
 .../fips_validation/fips_validation_eddsa.c   |    0
 .../fips_validation/fips_validation_gcm.c     |    0
 .../fips_validation/fips_validation_hmac.c    |    0
 .../fips_validation/fips_validation_rsa.c     |    0
 .../fips_validation/fips_validation_sha.c     |    0
 .../fips_validation/fips_validation_tdes.c    |    0
 .../fips_validation/fips_validation_xts.c     |    0
 .../fips_validation/main.c                    |    0
 .../fips_validation/meson.build               |    0
 .../wycheproof_validation/Makefile            |   40 +
 .../wycheproof_validation/main.c              | 2097 +++++++++++++++++
 .../wycheproof_validation/meson.build         |   18 +
 examples/meson.build                          |    3 +-
 26 files changed, 2221 insertions(+), 2 deletions(-)
 create mode 100644 doc/guides/sample_app_ug/wycheproof_validation.rst
 rename examples/{ => crypto_validation}/fips_validation/Makefile (100%)
 rename examples/{ => crypto_validation}/fips_validation/fips_dev_self_test.c (100%)
 rename examples/{ => crypto_validation}/fips_validation/fips_dev_self_test.h (100%)
 rename examples/{ => crypto_validation}/fips_validation/fips_validation.c (100%)
 rename examples/{ => crypto_validation}/fips_validation/fips_validation.h (100%)
 rename examples/{ => crypto_validation}/fips_validation/fips_validation_aes.c (100%)
 rename examples/{ => crypto_validation}/fips_validation/fips_validation_ccm.c (100%)
 rename examples/{ => crypto_validation}/fips_validation/fips_validation_cmac.c (100%)
 rename examples/{ => crypto_validation}/fips_validation/fips_validation_ecdsa.c (100%)
 rename examples/{ => crypto_validation}/fips_validation/fips_validation_eddsa.c (100%)
 rename examples/{ => crypto_validation}/fips_validation/fips_validation_gcm.c (100%)
 rename examples/{ => crypto_validation}/fips_validation/fips_validation_hmac.c (100%)
 rename examples/{ => crypto_validation}/fips_validation/fips_validation_rsa.c (100%)
 rename examples/{ => crypto_validation}/fips_validation/fips_validation_sha.c (100%)
 rename examples/{ => crypto_validation}/fips_validation/fips_validation_tdes.c (100%)
 rename examples/{ => crypto_validation}/fips_validation/fips_validation_xts.c (100%)
 rename examples/{ => crypto_validation}/fips_validation/main.c (100%)
 rename examples/{ => crypto_validation}/fips_validation/meson.build (100%)
 create mode 100644 examples/crypto_validation/wycheproof_validation/Makefile
 create mode 100644 examples/crypto_validation/wycheproof_validation/main.c
 create mode 100644 examples/crypto_validation/wycheproof_validation/meson.build

index 5bfb7b571d..3837abe84d 100644
@@ -2029,7 +2029,7 @@ F: doc/guides/sample_app_ug/ethtool.rst
 
 FIPS validation example
 M: Gowrishankar Muthukrishnan <[email protected]>
-F: examples/fips_validation/
+F: examples/crypto_validation/fips_validation/
 F: doc/guides/sample_app_ug/fips_validation.rst
 
 Flow filtering example

@@ -2103,3 +2103,8 @@ F: examples/vmdq/
 F: doc/guides/sample_app_ug/vmdq_forwarding.rst
 F: examples/vmdq_dcb/
 F: doc/guides/sample_app_ug/vmdq_dcb_forwarding.rst
+
+Wycheproof validation example
+M: Kai Ji <[email protected]>
+F: examples/crypto_validation/wycheproof_validation/
+F: doc/guides/sample_app_ug/wycheproof_validation.rst

index 25301088bf..f767d7965e 100644
@@ -163,6 +163,12 @@ New Features
   Added ``rte_bbdev_queue_stats_get()`` function to retrieve statistics
   for a specific queue, complementing the existing device-level statistics API.
 
+* **Added Wycheproof validation example application.**
+
+  Added a new example application that validates a DPDK cryptodev PMD against
+  the Google Wycheproof JSON test vectors, covering AEAD, MAC, DSA, ECDH and
+  ECDSA algorithm families.
+
 * **Supported auto-detection of uncore power driver.**
 
   The uncore power library got automatic probing of multiple uncore drivers

index 28c4c9a5b2..2458b06ccd 100644
@@ -51,6 +51,7 @@ Sample Applications User Guides
     ptpclient
     ptp_tap_relay_sw
     fips_validation
+    wycheproof_validation
     ipsec_secgw
     bbdev_app
     ntb

similarity index 100%
rename from examples/fips_validation/Makefile
rename to examples/crypto_validation/fips_validation/Makefile

similarity index 100%
rename from examples/fips_validation/fips_dev_self_test.c
rename to examples/crypto_validation/fips_validation/fips_dev_self_test.c

similarity index 100%
rename from examples/fips_validation/fips_dev_self_test.h
rename to examples/crypto_validation/fips_validation/fips_dev_self_test.h

similarity index 100%
rename from examples/fips_validation/fips_validation.c
rename to examples/crypto_validation/fips_validation/fips_validation.c

similarity index 100%
rename from examples/fips_validation/fips_validation.h
rename to examples/crypto_validation/fips_validation/fips_validation.h

similarity index 100%
rename from examples/fips_validation/fips_validation_aes.c
rename to examples/crypto_validation/fips_validation/fips_validation_aes.c

similarity index 100%
rename from examples/fips_validation/fips_validation_ccm.c
rename to examples/crypto_validation/fips_validation/fips_validation_ccm.c

similarity index 100%
rename from examples/fips_validation/fips_validation_cmac.c
rename to examples/crypto_validation/fips_validation/fips_validation_cmac.c

similarity index 100%
rename from examples/fips_validation/fips_validation_ecdsa.c
rename to examples/crypto_validation/fips_validation/fips_validation_ecdsa.c

similarity index 100%
rename from examples/fips_validation/fips_validation_eddsa.c
rename to examples/crypto_validation/fips_validation/fips_validation_eddsa.c

similarity index 100%
rename from examples/fips_validation/fips_validation_gcm.c
rename to examples/crypto_validation/fips_validation/fips_validation_gcm.c

similarity index 100%
rename from examples/fips_validation/fips_validation_hmac.c
rename to examples/crypto_validation/fips_validation/fips_validation_hmac.c

similarity index 100%
rename from examples/fips_validation/fips_validation_rsa.c
rename to examples/crypto_validation/fips_validation/fips_validation_rsa.c

similarity index 100%
rename from examples/fips_validation/fips_validation_sha.c
rename to examples/crypto_validation/fips_validation/fips_validation_sha.c

similarity index 100%
rename from examples/fips_validation/fips_validation_tdes.c
rename to examples/crypto_validation/fips_validation/fips_validation_tdes.c

similarity index 100%
rename from examples/fips_validation/fips_validation_xts.c
rename to examples/crypto_validation/fips_validation/fips_validation_xts.c

similarity index 100%
rename from examples/fips_validation/main.c
rename to examples/crypto_validation/fips_validation/main.c

similarity index 100%
rename from examples/fips_validation/meson.build
rename to examples/crypto_validation/fips_validation/meson.build

new file mode 100644
index 0000000000..25badf8780
@@ -0,0 +1,40 @@
+# SPDX-License-Identifier: BSD-3-Clause
+# Copyright(c) 2026
+
+APP = wycheproof_validation
+SRCS-y := main.c
+
+PKGCONF ?= pkg-config
+
+ifneq ($(shell $(PKGCONF) --exists libdpdk && echo 0),0)
+$(error "no installation of DPDK found")
+endif
+ifneq ($(shell $(PKGCONF) --exists jansson && echo 0),0)
+$(error "Jansson is required")
+endif
+
+all: shared
+.PHONY: shared static
+shared: build/$(APP)-shared
+	ln -sf $(APP)-shared build/$(APP)
+static: build/$(APP)-static
+	ln -sf $(APP)-static build/$(APP)
+
+PC_FILE := $(shell $(PKGCONF) --path libdpdk 2>/dev/null)
+CFLAGS += -O3 -DALLOW_EXPERIMENTAL_API $(shell $(PKGCONF) --cflags libdpdk jansson)
+LDFLAGS_SHARED = $(shell $(PKGCONF) --libs libdpdk jansson)
+LDFLAGS_STATIC = $(shell $(PKGCONF) --static --libs libdpdk jansson)
+
+build/$(APP)-shared: $(SRCS-y) Makefile $(PC_FILE) | build
+	$(CC) $(CFLAGS) $(SRCS-y) -o $@ $(LDFLAGS) $(LDFLAGS_SHARED)
+
+build/$(APP)-static: $(SRCS-y) Makefile $(PC_FILE) | build
+	$(CC) $(CFLAGS) $(SRCS-y) -o $@ $(LDFLAGS) $(LDFLAGS_STATIC)
+
+build:
+	@mkdir -p $@
+
+.PHONY: clean
+clean:
+	rm -f build/$(APP) build/$(APP)-static build/$(APP)-shared
+	test -d build && rmdir -p build || true

new file mode 100644
index 0000000000..8a0d0a39a7
@@ -0,0 +1,18 @@
+# SPDX-License-Identifier: BSD-3-Clause
+# Copyright(c) 2026
+
+# meson file, for building this example as part of a main DPDK build.
+#
+# To build this example as a standalone application with an already-installed
+# DPDK instance, use 'make'
+
+allow_experimental_apis = true
+deps += ['cryptodev']
+
+if not dpdk_conf.has('RTE_HAS_JANSSON')
+    build = false
+    message('Skipping wycheproof_validation: Jansson is required')
+else
+    ext_deps += jansson_dep
+    sources = files('main.c')
+endif

index 544ec5eadd..2c4bc6cbe0 100644
@@ -11,11 +11,12 @@ all_examples = [
         'bbdev_app',
         'bond',
         'cmdline',
+        'crypto_validation/fips_validation',
+        'crypto_validation/wycheproof_validation',
         'distributor',
         'dma',
         'ethtool',
         'eventdev_pipeline',
-        'fips_validation',
         'flow_filtering',
         'helloworld',
         'ip_fragmentation',

2.34.1

Can we split this patch into 2 patches or more patches.
- one to move fips. Rename fips_validation.rst to crypto_validation.rst and update it to have fips as one section
- others to add new app(logical split if possible). Add another section in crypto_validation.rst for Wycheproof.

Check multi_process.rst for reference.

Hi Kai,
As per the last DPDK call, Thomas suggested to move this app and the fips also to apps/ folder And update documentation accordingly.

Kai Ji (2):
app: move FIPS validation under app/
app: add Wycheproof validation app

 MAINTAINERS                                   |   11 +-
 {examples => app}/fips_validation/Makefile    |    0
 .../fips_validation/fips_dev_self_test.c      |    0
 .../fips_validation/fips_dev_self_test.h      |    0
 .../fips_validation/fips_validation.c         |    0
 .../fips_validation/fips_validation.h         |    0
 .../fips_validation/fips_validation_aes.c     |    0
 .../fips_validation/fips_validation_ccm.c     |    0
 .../fips_validation/fips_validation_cmac.c    |    0
 .../fips_validation/fips_validation_ecdsa.c   |    0
 .../fips_validation/fips_validation_eddsa.c   |    0
 .../fips_validation/fips_validation_gcm.c     |    0
 .../fips_validation/fips_validation_hmac.c    |    0
 .../fips_validation/fips_validation_rsa.c     |    0
 .../fips_validation/fips_validation_sha.c     |    0
 .../fips_validation/fips_validation_tdes.c    |    0
 .../fips_validation/fips_validation_xts.c     |    0
 {examples => app}/fips_validation/main.c      |    0
 {examples => app}/fips_validation/meson.build |    2 +-
 app/meson.build                               |    2 +
 app/wycheproof_validation/Makefile            |   40 +
 app/wycheproof_validation/main.c              | 2097 +++++++++++++++++
 app/wycheproof_validation/meson.build         |   18 +
 doc/guides/rel_notes/release_22_11.rst        |    2 +-
 doc/guides/rel_notes/release_26_11.rst        |    6 +
 ...s_validation.rst => crypto_validation.rst} |   85 +-
 doc/guides/sample_app_ug/index.rst            |    2 +-
 examples/meson.build                          |    1 -
 28 files changed, 2246 insertions(+), 20 deletions(-)
 rename {examples => app}/fips_validation/Makefile (100%)
 rename {examples => app}/fips_validation/fips_dev_self_test.c (100%)
 rename {examples => app}/fips_validation/fips_dev_self_test.h (100%)
 rename {examples => app}/fips_validation/fips_validation.c (100%)
 rename {examples => app}/fips_validation/fips_validation.h (100%)
 rename {examples => app}/fips_validation/fips_validation_aes.c (100%)
 rename {examples => app}/fips_validation/fips_validation_ccm.c (100%)
 rename {examples => app}/fips_validation/fips_validation_cmac.c (100%)
 rename {examples => app}/fips_validation/fips_validation_ecdsa.c (100%)
 rename {examples => app}/fips_validation/fips_validation_eddsa.c (100%)
 rename {examples => app}/fips_validation/fips_validation_gcm.c (100%)
 rename {examples => app}/fips_validation/fips_validation_hmac.c (100%)
 rename {examples => app}/fips_validation/fips_validation_rsa.c (100%)
 rename {examples => app}/fips_validation/fips_validation_sha.c (100%)
 rename {examples => app}/fips_validation/fips_validation_tdes.c (100%)
 rename {examples => app}/fips_validation/fips_validation_xts.c (100%)
 rename {examples => app}/fips_validation/main.c (100%)
 rename {examples => app}/fips_validation/meson.build (92%)
 create mode 100644 app/wycheproof_validation/Makefile
 create mode 100644 app/wycheproof_validation/main.c
 create mode 100644 app/wycheproof_validation/meson.build
 rename doc/guides/sample_app_ug/{fips_validation.rst => crypto_validation.rst} (70%)

2.34.1

Rename the sample guide to crypto_validation.rst and make FIPS validation its first section. Update the app registration and guide references to match the new location.

---
 MAINTAINERS                                   |  6 ++--
 {examples => app}/fips_validation/Makefile    |  0
 .../fips_validation/fips_dev_self_test.c      |  0
 .../fips_validation/fips_dev_self_test.h      |  0
 .../fips_validation/fips_validation.c         |  0
 .../fips_validation/fips_validation.h         |  0
 .../fips_validation/fips_validation_aes.c     |  0
 .../fips_validation/fips_validation_ccm.c     |  0
 .../fips_validation/fips_validation_cmac.c    |  0
 .../fips_validation/fips_validation_ecdsa.c   |  0
 .../fips_validation/fips_validation_eddsa.c   |  0
 .../fips_validation/fips_validation_gcm.c     |  0
 .../fips_validation/fips_validation_hmac.c    |  0
 .../fips_validation/fips_validation_rsa.c     |  0
 .../fips_validation/fips_validation_sha.c     |  0
 .../fips_validation/fips_validation_tdes.c    |  0
 .../fips_validation/fips_validation_xts.c     |  0
 {examples => app}/fips_validation/main.c      |  0
 {examples => app}/fips_validation/meson.build |  2 +-
 app/meson.build                               |  1 +
 doc/guides/rel_notes/release_22_11.rst        |  2 +-
 ...s_validation.rst => crypto_validation.rst} | 36 ++++++++++++-------
 doc/guides/sample_app_ug/index.rst            |  2 +-
 examples/meson.build                          |  1 -
 24 files changed, 30 insertions(+), 20 deletions(-)
 rename {examples => app}/fips_validation/Makefile (100%)
 rename {examples => app}/fips_validation/fips_dev_self_test.c (100%)
 rename {examples => app}/fips_validation/fips_dev_self_test.h (100%)
 rename {examples => app}/fips_validation/fips_validation.c (100%)
 rename {examples => app}/fips_validation/fips_validation.h (100%)
 rename {examples => app}/fips_validation/fips_validation_aes.c (100%)
 rename {examples => app}/fips_validation/fips_validation_ccm.c (100%)
 rename {examples => app}/fips_validation/fips_validation_cmac.c (100%)
 rename {examples => app}/fips_validation/fips_validation_ecdsa.c (100%)
 rename {examples => app}/fips_validation/fips_validation_eddsa.c (100%)
 rename {examples => app}/fips_validation/fips_validation_gcm.c (100%)
 rename {examples => app}/fips_validation/fips_validation_hmac.c (100%)
 rename {examples => app}/fips_validation/fips_validation_rsa.c (100%)
 rename {examples => app}/fips_validation/fips_validation_sha.c (100%)
 rename {examples => app}/fips_validation/fips_validation_tdes.c (100%)
 rename {examples => app}/fips_validation/fips_validation_xts.c (100%)
 rename {examples => app}/fips_validation/main.c (100%)
 rename {examples => app}/fips_validation/meson.build (92%)
 rename doc/guides/sample_app_ug/{fips_validation.rst => crypto_validation.rst} (89%)

index 1d865ffd46..736f39c70e 100644
@@ -2040,10 +2040,10 @@ Ethtool example
 F: examples/ethtool/
 F: doc/guides/sample_app_ug/ethtool.rst
 
-FIPS validation example
+FIPS validation application
 M: Gowrishankar Muthukrishnan <[email protected]>
-F: examples/fips_validation/
-F: doc/guides/sample_app_ug/fips_validation.rst
+F: app/fips_validation/
+F: doc/guides/sample_app_ug/crypto_validation.rst
 
 Flow filtering example
 M: Ori Kam <[email protected]>

similarity index 100%
rename from examples/fips_validation/Makefile
rename to app/fips_validation/Makefile

similarity index 100%
rename from examples/fips_validation/fips_dev_self_test.c
rename to app/fips_validation/fips_dev_self_test.c

similarity index 100%
rename from examples/fips_validation/fips_dev_self_test.h
rename to app/fips_validation/fips_dev_self_test.h

similarity index 100%
rename from examples/fips_validation/fips_validation.c
rename to app/fips_validation/fips_validation.c

similarity index 100%
rename from examples/fips_validation/fips_validation.h
rename to app/fips_validation/fips_validation.h

similarity index 100%
rename from examples/fips_validation/fips_validation_aes.c
rename to app/fips_validation/fips_validation_aes.c

similarity index 100%
rename from examples/fips_validation/fips_validation_ccm.c
rename to app/fips_validation/fips_validation_ccm.c

similarity index 100%
rename from examples/fips_validation/fips_validation_cmac.c
rename to app/fips_validation/fips_validation_cmac.c

similarity index 100%
rename from examples/fips_validation/fips_validation_ecdsa.c
rename to app/fips_validation/fips_validation_ecdsa.c

similarity index 100%
rename from examples/fips_validation/fips_validation_eddsa.c
rename to app/fips_validation/fips_validation_eddsa.c

similarity index 100%
rename from examples/fips_validation/fips_validation_gcm.c
rename to app/fips_validation/fips_validation_gcm.c

similarity index 100%
rename from examples/fips_validation/fips_validation_hmac.c
rename to app/fips_validation/fips_validation_hmac.c

similarity index 100%
rename from examples/fips_validation/fips_validation_rsa.c
rename to app/fips_validation/fips_validation_rsa.c

similarity index 100%
rename from examples/fips_validation/fips_validation_sha.c
rename to app/fips_validation/fips_validation_sha.c

similarity index 100%
rename from examples/fips_validation/fips_validation_tdes.c
rename to app/fips_validation/fips_validation_tdes.c

similarity index 100%
rename from examples/fips_validation/fips_validation_xts.c
rename to app/fips_validation/fips_validation_xts.c

similarity index 100%
rename from examples/fips_validation/main.c
rename to app/fips_validation/main.c

similarity index 92%
rename from examples/fips_validation/meson.build
rename to app/fips_validation/meson.build
index 6c29b535cb..3d1a7bc9a6 100644
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: BSD-3-Clause
 # Copyright(c) 2018 Intel Corporation
 
-# meson file, for building this example as part of a main DPDK build.
+# meson file, for building this application as part of a main DPDK build.
 #
 # To build this example as a standalone application with an already-installed
 # DPDK instance, use 'make'

index 24fadc1963..927f79d0b3 100644
@@ -14,6 +14,7 @@ endif
 
 apps = [
         'dumpcap',
+        'fips_validation',
         'graph',
         'pdump',
         'proc-info',

index a8d48344c3..f5d47de741 100644
@@ -273,7 +273,7 @@ New Features
 * **Updated FIPS validation sample application.**
 
   Added support for asymmetric crypto algorithms.
-  See the :doc:`/sample_app_ug/fips_validation` for more details.
+  See the :doc:`/sample_app_ug/crypto_validation` for more details.
 
 * **Rewrote pmdinfo script.**
 

similarity index 89%
rename from doc/guides/sample_app_ug/fips_validation.rst
rename to doc/guides/sample_app_ug/crypto_validation.rst
index 613c5afd19..2a773c9892 100644
@@ -1,11 +1,14 @@
 ..  SPDX-License-Identifier: BSD-3-Clause
     Copyright(c) 2018 Intel Corporation.
 
-Federal Information Processing Standards (FIPS) CryptoDev Validation
-====================================================================
+Cryptographic Validation Applications
+=====================================
+
+FIPS Validation
+---------------
 
 Overview
---------
+~~~~~~~~
 
 Federal Information Processing Standards (FIPS) are publicly announced standards
 developed by the United States federal government for use in computer systems by

@@ -22,10 +25,10 @@ and FIPS 140-3 (in case of ACVP) and must successfully complete the
 cryptographic algorithm validation process.
 
 Limitations
------------
+~~~~~~~~~~~
 
 CAVP
-----
+^^^^
 
 * The version of request file supported is ``CAVS 21.0``.
 * If the header comment in a ``.req`` file does not contain a Algo tag

@@ -52,7 +55,7 @@ CAVP
       VarText
 
 ACVP
-----
+^^^^
 
 * The application does not supply the test vectors. The user is expected to
   obtain the test vector files from `ACVP  <https://pages.nist.gov/ACVP>`_

@@ -76,7 +79,7 @@ ACVP
 
 
 Application Information
------------------------
+~~~~~~~~~~~~~~~~~~~~~~~
 
 If a ``.req`` is used as the input file after the application is finished
 running it will generate a response file or ``.rsp``. Differences between the

@@ -93,11 +96,18 @@ validating if the application has done the operation correctly.
 
 
 Compiling the Application
--------------------------
+~~~~~~~~~~~~~~~~~~~~~~~~~
 
 * Compile Application
 
-    To compile the sample application see :doc:`compiling`.
+    From the DPDK source tree, build the application with Meson:
+
+    .. code-block:: console
+
+       meson setup build -Denable_apps=fips_validation
+       meson compile -C build
+
+    The standalone Makefile can also be used from ``app/fips_validation``.
 
 *  Run ``dos2unix`` on the request files
 

@@ -112,13 +122,13 @@ Compiling the Application
          dos2unix SHA/req/*
 
 Running the Application
------------------------
+~~~~~~~~~~~~~~~~~~~~~~~
 
 The application requires a number of command line options:
 
     .. code-block:: console
 
-         ./dpdk-fips_validation [EAL options]
+         ./build/app/dpdk-fips_validation [EAL options]
          -- --req-file FILE_PATH/FOLDER_PATH
          --rsp-file FILE_PATH/FOLDER_PATH
          [--cryptodev DEVICE_NAME] [--cryptodev-id ID] [--path-is-folder]

@@ -149,7 +159,7 @@ file for crypto_aesni_mb PMD, issue the command:
 
 .. code-block:: console
 
-    $ ./dpdk-fips_validation --vdev crypto_aesni_mb --
+    $ ./build/app/dpdk-fips_validation --vdev crypto_aesni_mb --
     --req-file /PATH/TO/REQUEST/FILE.req --rsp-file ./PATH/TO/RESPONSE/FILE.rsp
     --cryptodev crypto_aesni_mb
 

@@ -158,7 +168,7 @@ data files in one folder for crypto_aesni_gcm PMD, issue the command:
 
 .. code-block:: console
 
-    $ ./dpdk-fips_validation --vdev crypto_aesni_gcm0 --
+    $ ./build/app/dpdk-fips_validation --vdev crypto_aesni_gcm0 --
     --req-file /PATH/TO/REQUEST/FILE/FOLDER/
     --rsp-file ./PATH/TO/RESPONSE/FILE/FOLDER/
     --cryptodev-id 0 --path-is-folder

index 28c4c9a5b2..a71d14f83f 100644
@@ -50,7 +50,7 @@ Sample Applications User Guides
     vm_power_management
     ptpclient
     ptp_tap_relay_sw
-    fips_validation
+    crypto_validation
     ipsec_secgw
     bbdev_app
     ntb

index 544ec5eadd..4b739c9b82 100644
@@ -15,7 +15,6 @@ all_examples = [
         'dma',
         'ethtool',
         'eventdev_pipeline',
-        'fips_validation',
         'flow_filtering',
         'helloworld',
         'ip_fragmentation',

2.34.1

Add a cryptodev validation application using Wycheproof JSON test vectors. Document it as a second section in the crypto validation guide.

---
 MAINTAINERS                                   |    5 +
 app/meson.build                               |    1 +
 app/wycheproof_validation/Makefile            |   40 +
 app/wycheproof_validation/main.c              | 2097 +++++++++++++++++
 app/wycheproof_validation/meson.build         |   18 +
 doc/guides/rel_notes/release_26_11.rst        |    6 +
 .../sample_app_ug/crypto_validation.rst       |   49 +
 7 files changed, 2216 insertions(+)
 create mode 100644 app/wycheproof_validation/Makefile
 create mode 100644 app/wycheproof_validation/main.c
 create mode 100644 app/wycheproof_validation/meson.build

index 736f39c70e..d258f4cea4 100644
@@ -2116,3 +2116,8 @@ F: examples/vmdq/
 F: doc/guides/sample_app_ug/vmdq_forwarding.rst
 F: examples/vmdq_dcb/
 F: doc/guides/sample_app_ug/vmdq_dcb_forwarding.rst
+
+Wycheproof validation application
+M: Kai Ji <[email protected]>
+F: app/wycheproof_validation/
+F: doc/guides/sample_app_ug/crypto_validation.rst

index 927f79d0b3..6239e05093 100644
@@ -34,6 +34,7 @@ apps = [
         'test-sad',
         'test-security-perf',
         'validate-bpf',
+        'wycheproof_validation',
 ]
 
 if get_option('tests')

new file mode 100644
index 0000000000..25badf8780
@@ -0,0 +1,40 @@
+# SPDX-License-Identifier: BSD-3-Clause
+# Copyright(c) 2026
+
+APP = wycheproof_validation
+SRCS-y := main.c
+
+PKGCONF ?= pkg-config
+
+ifneq ($(shell $(PKGCONF) --exists libdpdk && echo 0),0)
+$(error "no installation of DPDK found")
+endif
+ifneq ($(shell $(PKGCONF) --exists jansson && echo 0),0)
+$(error "Jansson is required")
+endif
+
+all: shared
+.PHONY: shared static
+shared: build/$(APP)-shared
+	ln -sf $(APP)-shared build/$(APP)
+static: build/$(APP)-static
+	ln -sf $(APP)-static build/$(APP)
+
+PC_FILE := $(shell $(PKGCONF) --path libdpdk 2>/dev/null)
+CFLAGS += -O3 -DALLOW_EXPERIMENTAL_API $(shell $(PKGCONF) --cflags libdpdk jansson)
+LDFLAGS_SHARED = $(shell $(PKGCONF) --libs libdpdk jansson)
+LDFLAGS_STATIC = $(shell $(PKGCONF) --static --libs libdpdk jansson)
+
+build/$(APP)-shared: $(SRCS-y) Makefile $(PC_FILE) | build
+	$(CC) $(CFLAGS) $(SRCS-y) -o $@ $(LDFLAGS) $(LDFLAGS_SHARED)
+
+build/$(APP)-static: $(SRCS-y) Makefile $(PC_FILE) | build
+	$(CC) $(CFLAGS) $(SRCS-y) -o $@ $(LDFLAGS) $(LDFLAGS_STATIC)
+
+build:
+	@mkdir -p $@
+
+.PHONY: clean
+clean:
+	rm -f build/$(APP) build/$(APP)-static build/$(APP)-shared
+	test -d build && rmdir -p build || true

new file mode 100644
index 0000000000..9599a3a977
@@ -0,0 +1,18 @@
+# SPDX-License-Identifier: BSD-3-Clause
+# Copyright(c) 2026
+
+# meson file, for building this application as part of a main DPDK build.
+#
+# To build this example as a standalone application with an already-installed
+# DPDK instance, use 'make'
+
+allow_experimental_apis = true
+deps += ['cryptodev']
+
+if not dpdk_conf.has('RTE_HAS_JANSSON')
+    build = false
+    message('Skipping wycheproof_validation: Jansson is required')
+else
+    ext_deps += jansson_dep
+    sources = files('main.c')
+endif

index 8ca8379cc6..20304c6a5f 100644
@@ -340,6 +340,12 @@ New Features
   Added ``dpdk-validate-bpf`` tool to pre-validate eBPF programs
   for compatibility with the ``lib/bpf`` execution context.
 
+* **Added Wycheproof validation application.**
+
+  Added a new application that validates a DPDK cryptodev PMD against
+  the Google Wycheproof JSON test vectors, covering AEAD, MAC, DSA, ECDH and
+  ECDSA algorithm families.
+
 
 Removed Items
 -------------

2.34.1

Move the FIPS validation example under app/ and add a new Wycheproof validation application that checks a cryptodev PMD against the Google Wycheproof JSON test vectors (AEAD, MAC, DSA, ECDH and ECDSA families).

v11:
- mark both applications as not supported on Windows in their meson files (they rely on POSIX directory handling); fixes the MinGW and MSVC CI build failures
- drop the standalone Makefiles: apps under app/ are built with meson only, and the examples-style Makefile needed the forbidden ALLOW_EXPERIMENTAL_API flag under app/
- remove forbidden allow_experimental_apis flag from app/ meson files (unused there: apps already build with ALLOW_EXPERIMENTAL_API)
- document the --mbuf-dataroom option in usage() and the guide
- print the correct program name in the usage message
- count unknown Wycheproof result strings as unsupported in the AES-GMAC processor, matching the other processors
- wipe the stack copy of the ECDH private key with rte_memzero_explicit() for consistency with rte_free_sensitive()

Kai Ji (2):
app: move FIPS validation under app/
app: add Wycheproof validation app

 MAINTAINERS                                   |   11 +-
 .../fips_validation/fips_dev_self_test.c      |    0
 .../fips_validation/fips_dev_self_test.h      |    0
 .../fips_validation/fips_validation.c         |    0
 .../fips_validation/fips_validation.h         |    0
 .../fips_validation/fips_validation_aes.c     |    0
 .../fips_validation/fips_validation_ccm.c     |    0
 .../fips_validation/fips_validation_cmac.c    |    0
 .../fips_validation/fips_validation_ecdsa.c   |    0
 .../fips_validation/fips_validation_eddsa.c   |    0
 .../fips_validation/fips_validation_gcm.c     |    0
 .../fips_validation/fips_validation_hmac.c    |    0
 .../fips_validation/fips_validation_rsa.c     |    0
 .../fips_validation/fips_validation_sha.c     |    0
 .../fips_validation/fips_validation_tdes.c    |    0
 .../fips_validation/fips_validation_xts.c     |    0
 {examples => app}/fips_validation/main.c      |    0
 {examples => app}/fips_validation/meson.build |   12 +-
 app/meson.build                               |    2 +
 app/wycheproof_validation/main.c              | 2106 +++++++++++++++++
 app/wycheproof_validation/meson.build         |   20 +
 doc/guides/rel_notes/release_22_11.rst        |    2 +-
 doc/guides/rel_notes/release_26_11.rst        |    6 +
 ...s_validation.rst => crypto_validation.rst} |   84 +-
 doc/guides/sample_app_ug/index.rst            |    2 +-
 examples/fips_validation/Makefile             |   62 -
 examples/meson.build                          |    1 -
 27 files changed, 2222 insertions(+), 86 deletions(-)
 rename {examples => app}/fips_validation/fips_dev_self_test.c (100%)
 rename {examples => app}/fips_validation/fips_dev_self_test.h (100%)
 rename {examples => app}/fips_validation/fips_validation.c (100%)
 rename {examples => app}/fips_validation/fips_validation.h (100%)
 rename {examples => app}/fips_validation/fips_validation_aes.c (100%)
 rename {examples => app}/fips_validation/fips_validation_ccm.c (100%)
 rename {examples => app}/fips_validation/fips_validation_cmac.c (100%)
 rename {examples => app}/fips_validation/fips_validation_ecdsa.c (100%)
 rename {examples => app}/fips_validation/fips_validation_eddsa.c (100%)
 rename {examples => app}/fips_validation/fips_validation_gcm.c (100%)
 rename {examples => app}/fips_validation/fips_validation_hmac.c (100%)
 rename {examples => app}/fips_validation/fips_validation_rsa.c (100%)
 rename {examples => app}/fips_validation/fips_validation_sha.c (100%)
 rename {examples => app}/fips_validation/fips_validation_tdes.c (100%)
 rename {examples => app}/fips_validation/fips_validation_xts.c (100%)
 rename {examples => app}/fips_validation/main.c (100%)
 rename {examples => app}/fips_validation/meson.build (79%)
 create mode 100644 app/wycheproof_validation/main.c
 create mode 100644 app/wycheproof_validation/meson.build
 rename doc/guides/sample_app_ug/{fips_validation.rst => crypto_validation.rst} (70%)
 delete mode 100644 examples/fips_validation/Makefile

2.34.1

Rename the sample guide to crypto_validation.rst and make FIPS validation its first section. Update the app registration and guide references to match the new location.

---
 MAINTAINERS                                   |  6 +-
 .../fips_validation/fips_dev_self_test.c      |  0
 .../fips_validation/fips_dev_self_test.h      |  0
 .../fips_validation/fips_validation.c         |  0
 .../fips_validation/fips_validation.h         |  0
 .../fips_validation/fips_validation_aes.c     |  0
 .../fips_validation/fips_validation_ccm.c     |  0
 .../fips_validation/fips_validation_cmac.c    |  0
 .../fips_validation/fips_validation_ecdsa.c   |  0
 .../fips_validation/fips_validation_eddsa.c   |  0
 .../fips_validation/fips_validation_gcm.c     |  0
 .../fips_validation/fips_validation_hmac.c    |  0
 .../fips_validation/fips_validation_rsa.c     |  0
 .../fips_validation/fips_validation_sha.c     |  0
 .../fips_validation/fips_validation_tdes.c    |  0
 .../fips_validation/fips_validation_xts.c     |  0
 {examples => app}/fips_validation/main.c      |  0
 {examples => app}/fips_validation/meson.build | 12 ++--
 app/meson.build                               |  1 +
 doc/guides/rel_notes/release_22_11.rst        |  2 +-
 ...s_validation.rst => crypto_validation.rst} | 34 ++++++----
 doc/guides/sample_app_ug/index.rst            |  2 +-
 examples/fips_validation/Makefile             | 62 -------------------
 examples/meson.build                          |  1 -
 24 files changed, 34 insertions(+), 86 deletions(-)
 rename {examples => app}/fips_validation/fips_dev_self_test.c (100%)
 rename {examples => app}/fips_validation/fips_dev_self_test.h (100%)
 rename {examples => app}/fips_validation/fips_validation.c (100%)
 rename {examples => app}/fips_validation/fips_validation.h (100%)
 rename {examples => app}/fips_validation/fips_validation_aes.c (100%)
 rename {examples => app}/fips_validation/fips_validation_ccm.c (100%)
 rename {examples => app}/fips_validation/fips_validation_cmac.c (100%)
 rename {examples => app}/fips_validation/fips_validation_ecdsa.c (100%)
 rename {examples => app}/fips_validation/fips_validation_eddsa.c (100%)
 rename {examples => app}/fips_validation/fips_validation_gcm.c (100%)
 rename {examples => app}/fips_validation/fips_validation_hmac.c (100%)
 rename {examples => app}/fips_validation/fips_validation_rsa.c (100%)
 rename {examples => app}/fips_validation/fips_validation_sha.c (100%)
 rename {examples => app}/fips_validation/fips_validation_tdes.c (100%)
 rename {examples => app}/fips_validation/fips_validation_xts.c (100%)
 rename {examples => app}/fips_validation/main.c (100%)
 rename {examples => app}/fips_validation/meson.build (79%)
 rename doc/guides/sample_app_ug/{fips_validation.rst => crypto_validation.rst} (90%)
 delete mode 100644 examples/fips_validation/Makefile

index 1d865ffd46..736f39c70e 100644
@@ -2040,10 +2040,10 @@ Ethtool example
 F: examples/ethtool/
 F: doc/guides/sample_app_ug/ethtool.rst
 
-FIPS validation example
+FIPS validation application
 M: Gowrishankar Muthukrishnan <[email protected]>
-F: examples/fips_validation/
-F: doc/guides/sample_app_ug/fips_validation.rst
+F: app/fips_validation/
+F: doc/guides/sample_app_ug/crypto_validation.rst
 
 Flow filtering example
 M: Ori Kam <[email protected]>

similarity index 100%
rename from examples/fips_validation/fips_dev_self_test.c
rename to app/fips_validation/fips_dev_self_test.c

similarity index 100%
rename from examples/fips_validation/fips_dev_self_test.h
rename to app/fips_validation/fips_dev_self_test.h

similarity index 100%
rename from examples/fips_validation/fips_validation.c
rename to app/fips_validation/fips_validation.c

similarity index 100%
rename from examples/fips_validation/fips_validation.h
rename to app/fips_validation/fips_validation.h

similarity index 100%
rename from examples/fips_validation/fips_validation_aes.c
rename to app/fips_validation/fips_validation_aes.c

similarity index 100%
rename from examples/fips_validation/fips_validation_ccm.c
rename to app/fips_validation/fips_validation_ccm.c

similarity index 100%
rename from examples/fips_validation/fips_validation_cmac.c
rename to app/fips_validation/fips_validation_cmac.c

similarity index 100%
rename from examples/fips_validation/fips_validation_ecdsa.c
rename to app/fips_validation/fips_validation_ecdsa.c

similarity index 100%
rename from examples/fips_validation/fips_validation_eddsa.c
rename to app/fips_validation/fips_validation_eddsa.c

similarity index 100%
rename from examples/fips_validation/fips_validation_gcm.c
rename to app/fips_validation/fips_validation_gcm.c

similarity index 100%
rename from examples/fips_validation/fips_validation_hmac.c
rename to app/fips_validation/fips_validation_hmac.c

similarity index 100%
rename from examples/fips_validation/fips_validation_rsa.c
rename to app/fips_validation/fips_validation_rsa.c

similarity index 100%
rename from examples/fips_validation/fips_validation_sha.c
rename to app/fips_validation/fips_validation_sha.c

similarity index 100%
rename from examples/fips_validation/fips_validation_tdes.c
rename to app/fips_validation/fips_validation_tdes.c

similarity index 100%
rename from examples/fips_validation/fips_validation_xts.c
rename to app/fips_validation/fips_validation_xts.c

similarity index 100%
rename from examples/fips_validation/main.c
rename to app/fips_validation/main.c

similarity index 79%
rename from examples/fips_validation/meson.build
rename to app/fips_validation/meson.build
index 6c29b535cb..d7055eca64 100644
@@ -1,13 +1,15 @@
 # SPDX-License-Identifier: BSD-3-Clause
 # Copyright(c) 2018 Intel Corporation
 
-# meson file, for building this example as part of a main DPDK build.
-#
-# To build this example as a standalone application with an already-installed
-# DPDK instance, use 'make'
+# meson file, for building this application as part of a main DPDK build.
+
+if is_windows
+    build = false
+    reason = 'not supported on Windows'
+    subdir_done()
+endif
 
 deps += ['cryptodev']
-allow_experimental_apis = true
 sources = files(
         'fips_validation_aes.c',
         'fips_validation.c',

index 24fadc1963..927f79d0b3 100644
@@ -14,6 +14,7 @@ endif
 
 apps = [
         'dumpcap',
+        'fips_validation',
         'graph',
         'pdump',
         'proc-info',

index a8d48344c3..f5d47de741 100644
@@ -273,7 +273,7 @@ New Features
 * **Updated FIPS validation sample application.**
 
   Added support for asymmetric crypto algorithms.
-  See the :doc:`/sample_app_ug/fips_validation` for more details.
+  See the :doc:`/sample_app_ug/crypto_validation` for more details.
 
 * **Rewrote pmdinfo script.**
 

similarity index 90%
rename from doc/guides/sample_app_ug/fips_validation.rst
rename to doc/guides/sample_app_ug/crypto_validation.rst
index 613c5afd19..67b9e2d351 100644
@@ -1,11 +1,14 @@
 ..  SPDX-License-Identifier: BSD-3-Clause
     Copyright(c) 2018 Intel Corporation.
 
-Federal Information Processing Standards (FIPS) CryptoDev Validation
-====================================================================
+Cryptographic Validation Applications
+=====================================
+
+FIPS Validation
+---------------
 
 Overview
---------
+~~~~~~~~
 
 Federal Information Processing Standards (FIPS) are publicly announced standards
 developed by the United States federal government for use in computer systems by

@@ -22,10 +25,10 @@ and FIPS 140-3 (in case of ACVP) and must successfully complete the
 cryptographic algorithm validation process.
 
 Limitations
------------
+~~~~~~~~~~~
 
 CAVP
-----
+^^^^
 
 * The version of request file supported is ``CAVS 21.0``.
 * If the header comment in a ``.req`` file does not contain a Algo tag

@@ -52,7 +55,7 @@ CAVP
       VarText
 
 ACVP
-----
+^^^^
 
 * The application does not supply the test vectors. The user is expected to
   obtain the test vector files from `ACVP  <https://pages.nist.gov/ACVP>`_

@@ -76,7 +79,7 @@ ACVP
 
 
 Application Information
------------------------
+~~~~~~~~~~~~~~~~~~~~~~~
 
 If a ``.req`` is used as the input file after the application is finished
 running it will generate a response file or ``.rsp``. Differences between the

@@ -93,11 +96,16 @@ validating if the application has done the operation correctly.
 
 
 Compiling the Application
--------------------------
+~~~~~~~~~~~~~~~~~~~~~~~~~
 
 * Compile Application
 
-    To compile the sample application see :doc:`compiling`.
+    From the DPDK source tree, build the application with Meson:
+
+    .. code-block:: console
+
+       meson setup build -Denable_apps=fips_validation
+       meson compile -C build
 
 *  Run ``dos2unix`` on the request files
 

@@ -112,13 +120,13 @@ Compiling the Application
          dos2unix SHA/req/*
 
 Running the Application
------------------------
+~~~~~~~~~~~~~~~~~~~~~~~
 
 The application requires a number of command line options:
 
     .. code-block:: console
 
-         ./dpdk-fips_validation [EAL options]
+         ./build/app/dpdk-fips_validation [EAL options]
          -- --req-file FILE_PATH/FOLDER_PATH
          --rsp-file FILE_PATH/FOLDER_PATH
          [--cryptodev DEVICE_NAME] [--cryptodev-id ID] [--path-is-folder]

@@ -149,7 +157,7 @@ file for crypto_aesni_mb PMD, issue the command:
 
 .. code-block:: console
 
-    $ ./dpdk-fips_validation --vdev crypto_aesni_mb --
+    $ ./build/app/dpdk-fips_validation --vdev crypto_aesni_mb --
     --req-file /PATH/TO/REQUEST/FILE.req --rsp-file ./PATH/TO/RESPONSE/FILE.rsp
     --cryptodev crypto_aesni_mb
 

@@ -158,7 +166,7 @@ data files in one folder for crypto_aesni_gcm PMD, issue the command:
 
 .. code-block:: console
 
-    $ ./dpdk-fips_validation --vdev crypto_aesni_gcm0 --
+    $ ./build/app/dpdk-fips_validation --vdev crypto_aesni_gcm0 --
     --req-file /PATH/TO/REQUEST/FILE/FOLDER/
     --rsp-file ./PATH/TO/RESPONSE/FILE/FOLDER/
     --cryptodev-id 0 --path-is-folder

index 28c4c9a5b2..a71d14f83f 100644
@@ -50,7 +50,7 @@ Sample Applications User Guides
     vm_power_management
     ptpclient
     ptp_tap_relay_sw
-    fips_validation
+    crypto_validation
     ipsec_secgw
     bbdev_app
     ntb

index 544ec5eadd..4b739c9b82 100644
@@ -15,7 +15,6 @@ all_examples = [
         'dma',
         'ethtool',
         'eventdev_pipeline',
-        'fips_validation',
         'flow_filtering',
         'helloworld',
         'ip_fragmentation',

2.34.1

Ci fix: https://patchwork.dpdk.org/project/ci/patch/[email protected]/
________________________________
From: Ji, Kai <[email protected]>
Sent: 06 November 2026 16:14
To: [email protected] <[email protected]>
Cc: Ji, Kai <[email protected]>; Thomas Monjalon <[email protected]>; Gowrishankar Muthukrishnan <[email protected]>
Subject: [dpdk-dev v11 1/2] app: move FIPS validation under app/

Rename the sample guide to crypto_validation.rst and make FIPS validation its first section. Update the app registration and guide references to match the new location.

---
 MAINTAINERS                                   |  6 +-
 .../fips_validation/fips_dev_self_test.c      |  0
 .../fips_validation/fips_dev_self_test.h      |  0
 .../fips_validation/fips_validation.c         |  0
 .../fips_validation/fips_validation.h         |  0
 .../fips_validation/fips_validation_aes.c     |  0
 .../fips_validation/fips_validation_ccm.c     |  0
 .../fips_validation/fips_validation_cmac.c    |  0
 .../fips_validation/fips_validation_ecdsa.c   |  0
 .../fips_validation/fips_validation_eddsa.c   |  0
 .../fips_validation/fips_validation_gcm.c     |  0
 .../fips_validation/fips_validation_hmac.c    |  0
 .../fips_validation/fips_validation_rsa.c     |  0
 .../fips_validation/fips_validation_sha.c     |  0
 .../fips_validation/fips_validation_tdes.c    |  0
 .../fips_validation/fips_validation_xts.c     |  0
 {examples => app}/fips_validation/main.c      |  0
 {examples => app}/fips_validation/meson.build | 12 ++--
 app/meson.build                               |  1 +
 doc/guides/rel_notes/release_22_11.rst        |  2 +-
 ...s_validation.rst => crypto_validation.rst} | 34 ++++++----
 doc/guides/sample_app_ug/index.rst            |  2 +-
 examples/fips_validation/Makefile             | 62 -------------------
 examples/meson.build                          |  1 -
 24 files changed, 34 insertions(+), 86 deletions(-)
 rename {examples => app}/fips_validation/fips_dev_self_test.c (100%)
 rename {examples => app}/fips_validation/fips_dev_self_test.h (100%)
 rename {examples => app}/fips_validation/fips_validation.c (100%)
 rename {examples => app}/fips_validation/fips_validation.h (100%)
 rename {examples => app}/fips_validation/fips_validation_aes.c (100%)
 rename {examples => app}/fips_validation/fips_validation_ccm.c (100%)
 rename {examples => app}/fips_validation/fips_validation_cmac.c (100%)
 rename {examples => app}/fips_validation/fips_validation_ecdsa.c (100%)
 rename {examples => app}/fips_validation/fips_validation_eddsa.c (100%)
 rename {examples => app}/fips_validation/fips_validation_gcm.c (100%)
 rename {examples => app}/fips_validation/fips_validation_hmac.c (100%)
 rename {examples => app}/fips_validation/fips_validation_rsa.c (100%)
 rename {examples => app}/fips_validation/fips_validation_sha.c (100%)
 rename {examples => app}/fips_validation/fips_validation_tdes.c (100%)
 rename {examples => app}/fips_validation/fips_validation_xts.c (100%)
 rename {examples => app}/fips_validation/main.c (100%)
 rename {examples => app}/fips_validation/meson.build (79%)
 rename doc/guides/sample_app_ug/{fips_validation.rst => crypto_validation.rst} (90%)
 delete mode 100644 examples/fips_validation/Makefile

index 1d865ffd46..736f39c70e 100644
@@ -2040,10 +2040,10 @@ Ethtool example
 F: examples/ethtool/
 F: doc/guides/sample_app_ug/ethtool.rst
 
-FIPS validation example
+FIPS validation application
 M: Gowrishankar Muthukrishnan <[email protected]>
-F: examples/fips_validation/
-F: doc/guides/sample_app_ug/fips_validation.rst
+F: app/fips_validation/
+F: doc/guides/sample_app_ug/crypto_validation.rst
 
 Flow filtering example
 M: Ori Kam <[email protected]>

similarity index 100%
rename from examples/fips_validation/fips_dev_self_test.c
rename to app/fips_validation/fips_dev_self_test.c

similarity index 100%
rename from examples/fips_validation/fips_dev_self_test.h
rename to app/fips_validation/fips_dev_self_test.h

similarity index 100%
rename from examples/fips_validation/fips_validation.c
rename to app/fips_validation/fips_validation.c

similarity index 100%
rename from examples/fips_validation/fips_validation.h
rename to app/fips_validation/fips_validation.h

similarity index 100%
rename from examples/fips_validation/fips_validation_aes.c
rename to app/fips_validation/fips_validation_aes.c

similarity index 100%
rename from examples/fips_validation/fips_validation_ccm.c
rename to app/fips_validation/fips_validation_ccm.c

similarity index 100%
rename from examples/fips_validation/fips_validation_cmac.c
rename to app/fips_validation/fips_validation_cmac.c

similarity index 100%
rename from examples/fips_validation/fips_validation_ecdsa.c
rename to app/fips_validation/fips_validation_ecdsa.c

similarity index 100%
rename from examples/fips_validation/fips_validation_eddsa.c
rename to app/fips_validation/fips_validation_eddsa.c

similarity index 100%
rename from examples/fips_validation/fips_validation_gcm.c
rename to app/fips_validation/fips_validation_gcm.c

similarity index 100%
rename from examples/fips_validation/fips_validation_hmac.c
rename to app/fips_validation/fips_validation_hmac.c

similarity index 100%
rename from examples/fips_validation/fips_validation_rsa.c
rename to app/fips_validation/fips_validation_rsa.c

similarity index 100%
rename from examples/fips_validation/fips_validation_sha.c
rename to app/fips_validation/fips_validation_sha.c

similarity index 100%
rename from examples/fips_validation/fips_validation_tdes.c
rename to app/fips_validation/fips_validation_tdes.c

similarity index 100%
rename from examples/fips_validation/fips_validation_xts.c
rename to app/fips_validation/fips_validation_xts.c

similarity index 100%
rename from examples/fips_validation/main.c
rename to app/fips_validation/main.c

similarity index 79%
rename from examples/fips_validation/meson.build
rename to app/fips_validation/meson.build
index 6c29b535cb..d7055eca64 100644
@@ -1,13 +1,15 @@
 # SPDX-License-Identifier: BSD-3-Clause
 # Copyright(c) 2018 Intel Corporation
 
-# meson file, for building this example as part of a main DPDK build.
-#
-# To build this example as a standalone application with an already-installed
-# DPDK instance, use 'make'
+# meson file, for building this application as part of a main DPDK build.
+
+if is_windows
+    build = false
+    reason = 'not supported on Windows'
+    subdir_done()
+endif
 
 deps += ['cryptodev']
-allow_experimental_apis = true
 sources = files(
         'fips_validation_aes.c',
         'fips_validation.c',

index 24fadc1963..927f79d0b3 100644
@@ -14,6 +14,7 @@ endif
 
 apps = [
         'dumpcap',
+        'fips_validation',
         'graph',
         'pdump',
         'proc-info',

index a8d48344c3..f5d47de741 100644
@@ -273,7 +273,7 @@ New Features
 * **Updated FIPS validation sample application.**
 
   Added support for asymmetric crypto algorithms.
-  See the :doc:`/sample_app_ug/fips_validation` for more details.
+  See the :doc:`/sample_app_ug/crypto_validation` for more details.
 
 * **Rewrote pmdinfo script.**
 

similarity index 90%
rename from doc/guides/sample_app_ug/fips_validation.rst
rename to doc/guides/sample_app_ug/crypto_validation.rst
index 613c5afd19..67b9e2d351 100644
@@ -1,11 +1,14 @@
 ..  SPDX-License-Identifier: BSD-3-Clause
     Copyright(c) 2018 Intel Corporation.
 
-Federal Information Processing Standards (FIPS) CryptoDev Validation
-====================================================================
+Cryptographic Validation Applications
+=====================================
+
+FIPS Validation
+---------------
 
 Overview
---------
+~~~~~~~~
 
 Federal Information Processing Standards (FIPS) are publicly announced standards
 developed by the United States federal government for use in computer systems by

@@ -22,10 +25,10 @@ and FIPS 140-3 (in case of ACVP) and must successfully complete the
 cryptographic algorithm validation process.
 
 Limitations
------------
+~~~~~~~~~~~
 
 CAVP
-----
+^^^^
 
 * The version of request file supported is ``CAVS 21.0``.
 * If the header comment in a ``.req`` file does not contain a Algo tag

@@ -52,7 +55,7 @@ CAVP
       VarText
 
 ACVP
-----
+^^^^
 
 * The application does not supply the test vectors. The user is expected to
   obtain the test vector files from `ACVP  <https://pages.nist.gov/ACVP>`_

@@ -76,7 +79,7 @@ ACVP
 
 
 Application Information
------------------------
+~~~~~~~~~~~~~~~~~~~~~~~
 
 If a ``.req`` is used as the input file after the application is finished
 running it will generate a response file or ``.rsp``. Differences between the

@@ -93,11 +96,16 @@ validating if the application has done the operation correctly.
 
 
 Compiling the Application
--------------------------
+~~~~~~~~~~~~~~~~~~~~~~~~~
 
 * Compile Application
 
-    To compile the sample application see :doc:`compiling`.
+    From the DPDK source tree, build the application with Meson:
+
+    .. code-block:: console
+
+       meson setup build -Denable_apps=fips_validation
+       meson compile -C build
 
 *  Run ``dos2unix`` on the request files
 

@@ -112,13 +120,13 @@ Compiling the Application
          dos2unix SHA/req/*
 
 Running the Application
------------------------
+~~~~~~~~~~~~~~~~~~~~~~~
 
 The application requires a number of command line options:
 
     .. code-block:: console
 
-         ./dpdk-fips_validation [EAL options]
+         ./build/app/dpdk-fips_validation [EAL options]
          -- --req-file FILE_PATH/FOLDER_PATH
          --rsp-file FILE_PATH/FOLDER_PATH
          [--cryptodev DEVICE_NAME] [--cryptodev-id ID] [--path-is-folder]

@@ -149,7 +157,7 @@ file for crypto_aesni_mb PMD, issue the command:
 
 .. code-block:: console
 
-    $ ./dpdk-fips_validation --vdev crypto_aesni_mb --
+    $ ./build/app/dpdk-fips_validation --vdev crypto_aesni_mb --
     --req-file /PATH/TO/REQUEST/FILE.req --rsp-file ./PATH/TO/RESPONSE/FILE.rsp
     --cryptodev crypto_aesni_mb
 

@@ -158,7 +166,7 @@ data files in one folder for crypto_aesni_gcm PMD, issue the command:
 
 .. code-block:: console
 
-    $ ./dpdk-fips_validation --vdev crypto_aesni_gcm0 --
+    $ ./build/app/dpdk-fips_validation --vdev crypto_aesni_gcm0 --
     --req-file /PATH/TO/REQUEST/FILE/FOLDER/
     --rsp-file ./PATH/TO/RESPONSE/FILE/FOLDER/
     --cryptodev-id 0 --path-is-folder

index 28c4c9a5b2..a71d14f83f 100644
@@ -50,7 +50,7 @@ Sample Applications User Guides
     vm_power_management
     ptpclient
     ptp_tap_relay_sw
-    fips_validation
+    crypto_validation
     ipsec_secgw
     bbdev_app
     ntb

index 544ec5eadd..4b739c9b82 100644
@@ -15,7 +15,6 @@ all_examples = [
         'dma',
         'ethtool',
         'eventdev_pipeline',
-        'fips_validation',
         'flow_filtering',
         'helloworld',
         'ip_fragmentation',

--
2.34.1

Add a cryptodev validation application using Wycheproof JSON test vectors. Document it as a second section in the crypto validation guide.

---
 MAINTAINERS                                   |    5 +
 app/meson.build                               |    1 +
 app/wycheproof_validation/main.c              | 2106 +++++++++++++++++
 app/wycheproof_validation/meson.build         |   20 +
 doc/guides/rel_notes/release_26_11.rst        |    6 +
 .../sample_app_ug/crypto_validation.rst       |   50 +
 6 files changed, 2188 insertions(+)
 create mode 100644 app/wycheproof_validation/main.c
 create mode 100644 app/wycheproof_validation/meson.build

index 736f39c70e..d258f4cea4 100644
@@ -2116,3 +2116,8 @@ F: examples/vmdq/
 F: doc/guides/sample_app_ug/vmdq_forwarding.rst
 F: examples/vmdq_dcb/
 F: doc/guides/sample_app_ug/vmdq_dcb_forwarding.rst
+
+Wycheproof validation application
+M: Kai Ji <[email protected]>
+F: app/wycheproof_validation/
+F: doc/guides/sample_app_ug/crypto_validation.rst

index 927f79d0b3..6239e05093 100644
@@ -34,6 +34,7 @@ apps = [
         'test-sad',
         'test-security-perf',
         'validate-bpf',
+        'wycheproof_validation',
 ]
 
 if get_option('tests')

new file mode 100644
index 0000000000..e032144bb4
@@ -0,0 +1,20 @@
+# SPDX-License-Identifier: BSD-3-Clause
+# Copyright(c) 2026
+
+# meson file, for building this application as part of a main DPDK build.
+
+if is_windows
+    build = false
+    reason = 'not supported on Windows'
+    subdir_done()
+endif
+
+deps += ['cryptodev']
+
+if not dpdk_conf.has('RTE_HAS_JANSSON')
+    build = false
+    message('Skipping wycheproof_validation: Jansson is required')
+else
+    ext_deps += jansson_dep
+    sources = files('main.c')
+endif

index 8ca8379cc6..20304c6a5f 100644
@@ -340,6 +340,12 @@ New Features
   Added ``dpdk-validate-bpf`` tool to pre-validate eBPF programs
   for compatibility with the ``lib/bpf`` execution context.
 
+* **Added Wycheproof validation application.**
+
+  Added a new application that validates a DPDK cryptodev PMD against
+  the Google Wycheproof JSON test vectors, covering AEAD, MAC, DSA, ECDH and
+  ECDSA algorithm families.
+
 
 Removed Items
 -------------

2.34.1

The directory for the doc must be doc/guides/tools/. I've fixed it and the dependency check message. Applied to make progress.

A quick AI pass shows some issues in the code:
- bad timeout handling
- MAC validation
and in the doc:
- no mention of the Jansson dependency
- no link to the Wycheproof vectors repository
- no coverage details

Please address in following patches, thanks.