arch/x86/include/asm/vdso/getrandom.h | 13 ------------- include/vdso/getrandom.h | 13 +++++++++++++ 2 files changed, 13 insertions(+), 13 deletions(-)
Having the prototype for __arch_chacha20_blocks_nostack in
arch/x86/include/asm/vdso/getrandom.h meant that the prototype and large
doc comment were cloned by every architecture, which has been causing
unnecessary churn. Instead move it into include/vdso/getrandom.h, where
it can be shared by all archs implementing it.
Suggested-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
---
arch/x86/include/asm/vdso/getrandom.h | 13 -------------
include/vdso/getrandom.h | 13 +++++++++++++
2 files changed, 13 insertions(+), 13 deletions(-)
diff --git a/arch/x86/include/asm/vdso/getrandom.h b/arch/x86/include/asm/vdso/getrandom.h
index b96e674cafde..ff5334ad32a0 100644
--- a/arch/x86/include/asm/vdso/getrandom.h
+++ b/arch/x86/include/asm/vdso/getrandom.h
@@ -37,19 +37,6 @@ static __always_inline const struct vdso_rng_data *__arch_get_vdso_rng_data(void
return &__vdso_rng_data;
}
-/**
- * __arch_chacha20_blocks_nostack - Generate ChaCha20 stream without using the stack.
- * @dst_bytes: Destination buffer to hold @nblocks * 64 bytes of output.
- * @key: 32-byte input key.
- * @counter: 8-byte counter, read on input and updated on return.
- * @nblocks: Number of blocks to generate.
- *
- * Generates a given positive number of blocks of ChaCha20 output with nonce=0, and does not write
- * to any stack or memory outside of the parameters passed to it, in order to mitigate stack data
- * leaking into forked child processes.
- */
-extern void __arch_chacha20_blocks_nostack(u8 *dst_bytes, const u32 *key, u32 *counter, size_t nblocks);
-
#endif /* !__ASSEMBLY__ */
#endif /* __ASM_VDSO_GETRANDOM_H */
diff --git a/include/vdso/getrandom.h b/include/vdso/getrandom.h
index a8b7c14b0ae0..4cf02e678f5e 100644
--- a/include/vdso/getrandom.h
+++ b/include/vdso/getrandom.h
@@ -43,4 +43,17 @@ struct vgetrandom_state {
bool in_use;
};
+/**
+ * __arch_chacha20_blocks_nostack - Generate ChaCha20 stream without using the stack.
+ * @dst_bytes: Destination buffer to hold @nblocks * 64 bytes of output.
+ * @key: 32-byte input key.
+ * @counter: 8-byte counter, read on input and updated on return.
+ * @nblocks: Number of blocks to generate.
+ *
+ * Generates a given positive number of blocks of ChaCha20 output with nonce=0, and does not write
+ * to any stack or memory outside of the parameters passed to it, in order to mitigate stack data
+ * leaking into forked child processes.
+ */
+extern void __arch_chacha20_blocks_nostack(u8 *dst_bytes, const u32 *key, u32 *counter, size_t nblocks);
+
#endif /* _VDSO_GETRANDOM_H */
--
2.46.0Having the prototype for __arch_chacha20_blocks_nostack in
arch/x86/include/asm/vdso/getrandom.h meant that the prototype and large
doc comment were cloned by every architecture, which has been causing
unnecessary churn. Instead move it into include/vdso/getrandom.h, where
it can be shared by all archs implementing it.
As a side bonus, this then lets us use that prototype in the
vdso_test_chacha self test, to ensure that it matches the source, and
indeed doing so turned up some inconsistencies, which are rectified
here.
Suggested-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
---
arch/x86/include/asm/vdso/getrandom.h | 13 -------------
include/vdso/getrandom.h | 13 +++++++++++++
tools/testing/selftests/vDSO/vdso_test_chacha.c | 10 +++++++---
3 files changed, 20 insertions(+), 16 deletions(-)
diff --git a/arch/x86/include/asm/vdso/getrandom.h b/arch/x86/include/asm/vdso/getrandom.h
index b96e674cafde..ff5334ad32a0 100644
--- a/arch/x86/include/asm/vdso/getrandom.h
+++ b/arch/x86/include/asm/vdso/getrandom.h
@@ -37,19 +37,6 @@ static __always_inline const struct vdso_rng_data *__arch_get_vdso_rng_data(void
return &__vdso_rng_data;
}
-/**
- * __arch_chacha20_blocks_nostack - Generate ChaCha20 stream without using the stack.
- * @dst_bytes: Destination buffer to hold @nblocks * 64 bytes of output.
- * @key: 32-byte input key.
- * @counter: 8-byte counter, read on input and updated on return.
- * @nblocks: Number of blocks to generate.
- *
- * Generates a given positive number of blocks of ChaCha20 output with nonce=0, and does not write
- * to any stack or memory outside of the parameters passed to it, in order to mitigate stack data
- * leaking into forked child processes.
- */
-extern void __arch_chacha20_blocks_nostack(u8 *dst_bytes, const u32 *key, u32 *counter, size_t nblocks);
-
#endif /* !__ASSEMBLY__ */
#endif /* __ASM_VDSO_GETRANDOM_H */
diff --git a/include/vdso/getrandom.h b/include/vdso/getrandom.h
index a8b7c14b0ae0..4cf02e678f5e 100644
--- a/include/vdso/getrandom.h
+++ b/include/vdso/getrandom.h
@@ -43,4 +43,17 @@ struct vgetrandom_state {
bool in_use;
};
+/**
+ * __arch_chacha20_blocks_nostack - Generate ChaCha20 stream without using the stack.
+ * @dst_bytes: Destination buffer to hold @nblocks * 64 bytes of output.
+ * @key: 32-byte input key.
+ * @counter: 8-byte counter, read on input and updated on return.
+ * @nblocks: Number of blocks to generate.
+ *
+ * Generates a given positive number of blocks of ChaCha20 output with nonce=0, and does not write
+ * to any stack or memory outside of the parameters passed to it, in order to mitigate stack data
+ * leaking into forked child processes.
+ */
+extern void __arch_chacha20_blocks_nostack(u8 *dst_bytes, const u32 *key, u32 *counter, size_t nblocks);
+
#endif /* _VDSO_GETRANDOM_H */
diff --git a/tools/testing/selftests/vDSO/vdso_test_chacha.c b/tools/testing/selftests/vDSO/vdso_test_chacha.c
index e38f44e5f803..ca5639d02969 100644
--- a/tools/testing/selftests/vDSO/vdso_test_chacha.c
+++ b/tools/testing/selftests/vDSO/vdso_test_chacha.c
@@ -7,16 +7,20 @@
#include <sys/random.h>
#include <string.h>
#include <stdint.h>
+#include <stdbool.h>
#include "../kselftest.h"
-extern void __arch_chacha20_blocks_nostack(uint8_t *dst_bytes, const uint8_t *key, uint32_t *counter, size_t nblocks);
+typedef uint8_t u8;
+typedef uint32_t u32;
+typedef uint64_t u64;
+#include <vdso/getrandom.h>
int main(int argc, char *argv[])
{
enum { TRIALS = 1000, BLOCKS = 128, BLOCK_SIZE = 64 };
static const uint8_t nonce[8] = { 0 };
uint32_t counter[2];
- uint8_t key[32];
+ uint32_t key[8];
uint8_t output1[BLOCK_SIZE * BLOCKS], output2[BLOCK_SIZE * BLOCKS];
ksft_print_header();
@@ -27,7 +31,7 @@ int main(int argc, char *argv[])
printf("getrandom() failed!\n");
return KSFT_SKIP;
}
- crypto_stream_chacha20(output1, sizeof(output1), nonce, key);
+ crypto_stream_chacha20(output1, sizeof(output1), nonce, (uint8_t *)key);
for (unsigned int split = 0; split < BLOCKS; ++split) {
memset(output2, 'X', sizeof(output2));
memset(counter, 0, sizeof(counter));
--
2.46.0
Le 27/08/2024 à 17:47, Jason A. Donenfeld a écrit :
> Having the prototype for __arch_chacha20_blocks_nostack in
> arch/x86/include/asm/vdso/getrandom.h meant that the prototype and large
> doc comment were cloned by every architecture, which has been causing
> unnecessary churn. Instead move it into include/vdso/getrandom.h, where
> it can be shared by all archs implementing it.
>
> As a side bonus, this then lets us use that prototype in the
> vdso_test_chacha self test, to ensure that it matches the source, and
> indeed doing so turned up some inconsistencies, which are rectified
> here.
Side bonus that I dislike. Or ... it is all that u32 key stuff that I
dislike.
If it was really u32 I would be able to read it with a LWZ instruction
(Load Word Zero extended). That's what I did at the begining. But if I
want the selftest to work, I have to use LWBRX (Load Word Byte Reversed
...)instead because the bytes in the word are in reversed order in reality.
So either it is a table of 32 bytes, or it is as defined in RFC 7539:
A 256-bit key, treated as a concatenation of eight 32-bit
little-endian integers.
And in that case it is not a table of 8x u32 but table of 8x __le32
>
> Suggested-by: Christophe Leroy <christophe.leroy@csgroup.eu>
> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
> ---
> diff --git a/tools/testing/selftests/vDSO/vdso_test_chacha.c b/tools/testing/selftests/vDSO/vdso_test_chacha.c
> index e38f44e5f803..ca5639d02969 100644
> --- a/tools/testing/selftests/vDSO/vdso_test_chacha.c
> +++ b/tools/testing/selftests/vDSO/vdso_test_chacha.c
> @@ -7,16 +7,20 @@
> #include <sys/random.h>
> #include <string.h>
> #include <stdint.h>
> +#include <stdbool.h>
> #include "../kselftest.h"
>
> -extern void __arch_chacha20_blocks_nostack(uint8_t *dst_bytes, const uint8_t *key, uint32_t *counter, size_t nblocks);
> +typedef uint8_t u8;
> +typedef uint32_t u32;
> +typedef uint64_t u64;
> +#include <vdso/getrandom.h>
>
> int main(int argc, char *argv[])
> {
> enum { TRIALS = 1000, BLOCKS = 128, BLOCK_SIZE = 64 };
> static const uint8_t nonce[8] = { 0 };
> uint32_t counter[2];
> - uint8_t key[32];
> + uint32_t key[8];
> uint8_t output1[BLOCK_SIZE * BLOCKS], output2[BLOCK_SIZE * BLOCKS];
>
> ksft_print_header();
> @@ -27,7 +31,7 @@ int main(int argc, char *argv[])
> printf("getrandom() failed!\n");
> return KSFT_SKIP;
> }
> - crypto_stream_chacha20(output1, sizeof(output1), nonce, key);
> + crypto_stream_chacha20(output1, sizeof(output1), nonce, (uint8_t *)key);
> for (unsigned int split = 0; split < BLOCKS; ++split) {
> memset(output2, 'X', sizeof(output2));
> memset(counter, 0, sizeof(counter));
On Tue, Aug 27, 2024 at 6:53 PM Christophe Leroy <christophe.leroy@csgroup.eu> wrote: > > > > Le 27/08/2024 à 17:47, Jason A. Donenfeld a écrit : > > Having the prototype for __arch_chacha20_blocks_nostack in > > arch/x86/include/asm/vdso/getrandom.h meant that the prototype and large > > doc comment were cloned by every architecture, which has been causing > > unnecessary churn. Instead move it into include/vdso/getrandom.h, where > > it can be shared by all archs implementing it. > > > > As a side bonus, this then lets us use that prototype in the > > vdso_test_chacha self test, to ensure that it matches the source, and > > indeed doing so turned up some inconsistencies, which are rectified > > here. > > Side bonus that I dislike. Or ... it is all that u32 key stuff that I > dislike. > > If it was really u32 I would be able to read it with a LWZ instruction > (Load Word Zero extended). That's what I did at the begining. But if I > want the selftest to work, I have to use LWBRX (Load Word Byte Reversed > ...)instead because the bytes in the word are in reversed order in reality. > > So either it is a table of 32 bytes, or it is as defined in RFC 7539: > > A 256-bit key, treated as a concatenation of eight 32-bit > little-endian integers. > > And in that case it is not a table of 8x u32 but table of 8x __le32 It's a table of bytes that are 4-byte aligned. Or, sure, a table of __le32.
© 2016 - 2025 Red Hat, Inc.