Having the prototype for __arch_chacha20_blocks_nostack in
arch/x86/include/asm/vdso/getrandom.h meant that the prototype and large
doc comment were cloned by every architecture, which has been causing
unnecessary churn. Instead move it into include/vdso/getrandom.h, where
it can be shared by all archs implementing it.

As a side bonus, this then lets us use that prototype in the
vdso_test_chacha self test, to ensure that it matches the source, and
indeed doing so turned up some inconsistencies, which are rectified
here.

Suggested-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
---
 arch/x86/include/asm/vdso/getrandom.h           | 13 -------------
 include/vdso/getrandom.h                        | 13 +++++++++++++
 tools/testing/selftests/vDSO/vdso_test_chacha.c | 10 +++++++---
 3 files changed, 20 insertions(+), 16 deletions(-)

diff --git a/arch/x86/include/asm/vdso/getrandom.h b/arch/x86/include/asm/vdso/getrandom.h
index b96e674cafde..ff5334ad32a0 100644
--- a/arch/x86/include/asm/vdso/getrandom.h
+++ b/arch/x86/include/asm/vdso/getrandom.h
@@ -37,19 +37,6 @@ static __always_inline const struct vdso_rng_data *__arch_get_vdso_rng_data(void
 	return &__vdso_rng_data;
 }
 
-/**
- * __arch_chacha20_blocks_nostack - Generate ChaCha20 stream without using the stack.
- * @dst_bytes:	Destination buffer to hold @nblocks * 64 bytes of output.
- * @key:	32-byte input key.
- * @counter:	8-byte counter, read on input and updated on return.
- * @nblocks:	Number of blocks to generate.
- *
- * Generates a given positive number of blocks of ChaCha20 output with nonce=0, and does not write
- * to any stack or memory outside of the parameters passed to it, in order to mitigate stack data
- * leaking into forked child processes.
- */
-extern void __arch_chacha20_blocks_nostack(u8 *dst_bytes, const u32 *key, u32 *counter, size_t nblocks);
-
 #endif /* !__ASSEMBLY__ */
 
 #endif /* __ASM_VDSO_GETRANDOM_H */
diff --git a/include/vdso/getrandom.h b/include/vdso/getrandom.h
index a8b7c14b0ae0..4cf02e678f5e 100644
--- a/include/vdso/getrandom.h
+++ b/include/vdso/getrandom.h
@@ -43,4 +43,17 @@ struct vgetrandom_state {
 	bool 			in_use;
 };
 
+/**
+ * __arch_chacha20_blocks_nostack - Generate ChaCha20 stream without using the stack.
+ * @dst_bytes:	Destination buffer to hold @nblocks * 64 bytes of output.
+ * @key:	32-byte input key.
+ * @counter:	8-byte counter, read on input and updated on return.
+ * @nblocks:	Number of blocks to generate.
+ *
+ * Generates a given positive number of blocks of ChaCha20 output with nonce=0, and does not write
+ * to any stack or memory outside of the parameters passed to it, in order to mitigate stack data
+ * leaking into forked child processes.
+ */
+extern void __arch_chacha20_blocks_nostack(u8 *dst_bytes, const u32 *key, u32 *counter, size_t nblocks);
+
 #endif /* _VDSO_GETRANDOM_H */
diff --git a/tools/testing/selftests/vDSO/vdso_test_chacha.c b/tools/testing/selftests/vDSO/vdso_test_chacha.c
index e38f44e5f803..ca5639d02969 100644
--- a/tools/testing/selftests/vDSO/vdso_test_chacha.c
+++ b/tools/testing/selftests/vDSO/vdso_test_chacha.c
@@ -7,16 +7,20 @@
 #include <sys/random.h>
 #include <string.h>
 #include <stdint.h>
+#include <stdbool.h>
 #include "../kselftest.h"
 
-extern void __arch_chacha20_blocks_nostack(uint8_t *dst_bytes, const uint8_t *key, uint32_t *counter, size_t nblocks);
+typedef uint8_t u8;
+typedef uint32_t u32;
+typedef uint64_t u64;
+#include <vdso/getrandom.h>
 
 int main(int argc, char *argv[])
 {
 	enum { TRIALS = 1000, BLOCKS = 128, BLOCK_SIZE = 64 };
 	static const uint8_t nonce[8] = { 0 };
 	uint32_t counter[2];
-	uint8_t key[32];
+	uint32_t key[8];
 	uint8_t output1[BLOCK_SIZE * BLOCKS], output2[BLOCK_SIZE * BLOCKS];
 
 	ksft_print_header();
@@ -27,7 +31,7 @@ int main(int argc, char *argv[])
 			printf("getrandom() failed!\n");
 			return KSFT_SKIP;
 		}
-		crypto_stream_chacha20(output1, sizeof(output1), nonce, key);
+		crypto_stream_chacha20(output1, sizeof(output1), nonce, (uint8_t *)key);
 		for (unsigned int split = 0; split < BLOCKS; ++split) {
 			memset(output2, 'X', sizeof(output2));
 			memset(counter, 0, sizeof(counter));
-- 
2.46.0

Le 27/08/2024 à 17:47, Jason A. Donenfeld a écrit :
> Having the prototype for __arch_chacha20_blocks_nostack in
> arch/x86/include/asm/vdso/getrandom.h meant that the prototype and large
> doc comment were cloned by every architecture, which has been causing
> unnecessary churn. Instead move it into include/vdso/getrandom.h, where
> it can be shared by all archs implementing it.
> 
> As a side bonus, this then lets us use that prototype in the
> vdso_test_chacha self test, to ensure that it matches the source, and
> indeed doing so turned up some inconsistencies, which are rectified
> here.

Side bonus that I dislike. Or ... it is all that u32 key stuff that I 
dislike.

If it was really u32 I would be able to read it with a LWZ instruction 
(Load Word Zero extended). That's what I did at the begining. But if I 
want the selftest to work, I have to use LWBRX (Load Word Byte Reversed 
...)instead  because the bytes in the word are in reversed order in reality.

So either it is a table of 32 bytes, or it is as defined in RFC 7539:

   A 256-bit key, treated as a concatenation of eight 32-bit 
little-endian integers.

And in that case it is not a table of 8x u32 but table of 8x __le32

> 
> Suggested-by: Christophe Leroy <christophe.leroy@csgroup.eu>
> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
> ---


> diff --git a/tools/testing/selftests/vDSO/vdso_test_chacha.c b/tools/testing/selftests/vDSO/vdso_test_chacha.c
> index e38f44e5f803..ca5639d02969 100644
> --- a/tools/testing/selftests/vDSO/vdso_test_chacha.c
> +++ b/tools/testing/selftests/vDSO/vdso_test_chacha.c
> @@ -7,16 +7,20 @@
>   #include <sys/random.h>
>   #include <string.h>
>   #include <stdint.h>
> +#include <stdbool.h>
>   #include "../kselftest.h"
>   
> -extern void __arch_chacha20_blocks_nostack(uint8_t *dst_bytes, const uint8_t *key, uint32_t *counter, size_t nblocks);
> +typedef uint8_t u8;
> +typedef uint32_t u32;
> +typedef uint64_t u64;
> +#include <vdso/getrandom.h>
>   
>   int main(int argc, char *argv[])
>   {
>   	enum { TRIALS = 1000, BLOCKS = 128, BLOCK_SIZE = 64 };
>   	static const uint8_t nonce[8] = { 0 };
>   	uint32_t counter[2];
> -	uint8_t key[32];
> +	uint32_t key[8];
>   	uint8_t output1[BLOCK_SIZE * BLOCKS], output2[BLOCK_SIZE * BLOCKS];
>   
>   	ksft_print_header();
> @@ -27,7 +31,7 @@ int main(int argc, char *argv[])
>   			printf("getrandom() failed!\n");
>   			return KSFT_SKIP;
>   		}
> -		crypto_stream_chacha20(output1, sizeof(output1), nonce, key);
> +		crypto_stream_chacha20(output1, sizeof(output1), nonce, (uint8_t *)key);
>   		for (unsigned int split = 0; split < BLOCKS; ++split) {
>   			memset(output2, 'X', sizeof(output2));
>   			memset(counter, 0, sizeof(counter));

On Tue, Aug 27, 2024 at 6:53 PM Christophe Leroy
<christophe.leroy@csgroup.eu> wrote:
>
>
>
> Le 27/08/2024 à 17:47, Jason A. Donenfeld a écrit :
> > Having the prototype for __arch_chacha20_blocks_nostack in
> > arch/x86/include/asm/vdso/getrandom.h meant that the prototype and large
> > doc comment were cloned by every architecture, which has been causing
> > unnecessary churn. Instead move it into include/vdso/getrandom.h, where
> > it can be shared by all archs implementing it.
> >
> > As a side bonus, this then lets us use that prototype in the
> > vdso_test_chacha self test, to ensure that it matches the source, and
> > indeed doing so turned up some inconsistencies, which are rectified
> > here.
>
> Side bonus that I dislike. Or ... it is all that u32 key stuff that I
> dislike.
>
> If it was really u32 I would be able to read it with a LWZ instruction
> (Load Word Zero extended). That's what I did at the begining. But if I
> want the selftest to work, I have to use LWBRX (Load Word Byte Reversed
> ...)instead  because the bytes in the word are in reversed order in reality.
>
> So either it is a table of 32 bytes, or it is as defined in RFC 7539:
>
>    A 256-bit key, treated as a concatenation of eight 32-bit
> little-endian integers.
>
> And in that case it is not a table of 8x u32 but table of 8x __le32

It's a table of bytes that are 4-byte aligned. Or, sure, a table of __le32.