c: specify static array size in function params

The C standard states:

  A declaration of a parameter as ``array of type'' shall be adjusted to ``qualified pointer to
  type'', where the type qualifiers (if any) are those specified within the [ and ] of the
  array type derivation. If the keyword static also appears within the [ and ] of the
  array type derivation, then for each call to the function, the value of the corresponding
  actual argument shall provide access to the first element of an array with at least as many
  elements as specified by the size expression.

By changing void func(int array[4]) to void func(int array[static 4]),
we automatically get the compiler checking argument sizes for us, which
is quite nice.

17 files changed, 58 insertions, 58 deletions

diff --git a/src/cookie.c b/src/cookie.c
index 0409b56..614393e 100644
--- a/src/cookie.c
+++ b/src/cookie.c
@@ -32,7 +32,7 @@ void cookie_init(struct cookie *cookie)
 	init_rwsem(&cookie->lock);
 }
 
-static void compute_mac1(u8 mac1[COOKIE_LEN], const void *message, size_t len, const u8 pubkey[NOISE_PUBLIC_KEY_LEN], const u8 psk[NOISE_SYMMETRIC_KEY_LEN])
+static void compute_mac1(u8 mac1[static COOKIE_LEN], const void *message, size_t len, const u8 pubkey[static NOISE_PUBLIC_KEY_LEN], const u8 psk[static NOISE_SYMMETRIC_KEY_LEN])
 {
 	struct blake2s_state state;
 	len = len - sizeof(struct message_macs) + offsetof(struct message_macs, mac1);
@@ -46,7 +46,7 @@ static void compute_mac1(u8 mac1[COOKIE_LEN], const void *message, size_t len, c
 	blake2s_final(&state, mac1, COOKIE_LEN);
 }
 
-static void compute_mac2(u8 mac2[COOKIE_LEN], const void *message, size_t len, const u8 cookie[COOKIE_LEN])
+static void compute_mac2(u8 mac2[static COOKIE_LEN], const void *message, size_t len, const u8 cookie[static COOKIE_LEN])
 {
 	len = len - sizeof(struct message_macs) + offsetof(struct message_macs, mac2);
 	blake2s(mac2, message, cookie, COOKIE_LEN, len, COOKIE_LEN);
@@ -69,7 +69,7 @@ static inline void put_secret(struct cookie_checker *checker)
 	up_read(&checker->secret_lock);
 }
 
-static void make_cookie(u8 cookie[COOKIE_LEN], struct sk_buff *skb, struct cookie_checker *checker)
+static void make_cookie(u8 cookie[static COOKIE_LEN], struct sk_buff *skb, struct cookie_checker *checker)
 {
 	struct blake2s_state state;
 	const u8 *secret;
diff --git a/src/crypto/chacha20poly1305.c b/src/crypto/chacha20poly1305.c
index 9f21060..34ee77d 100644
--- a/src/crypto/chacha20poly1305.c
+++ b/src/crypto/chacha20poly1305.c
@@ -139,7 +139,7 @@ static void chacha20_generic_block(struct chacha20_ctx *ctx, void *stream)
 	ctx->state[12]++;
 }
 
-static void chacha20_keysetup(struct chacha20_ctx *ctx, const u8 key[32], const u8 nonce[8])
+static void chacha20_keysetup(struct chacha20_ctx *ctx, const u8 key[static 32], const u8 nonce[static 8])
 {
 	static const char constant[16] = "expand 32-byte k";
 	ctx->state[0]  = le32_to_cpuvp(constant +  0);
@@ -246,7 +246,7 @@ struct poly1305_ctx {
 	u32 r4[5];
 };
 
-static void poly1305_init(struct poly1305_ctx *ctx, const u8 key[POLY1305_KEY_SIZE])
+static void poly1305_init(struct poly1305_ctx *ctx, const u8 key[static POLY1305_KEY_SIZE])
 {
 	memset(ctx, 0, sizeof(struct poly1305_ctx));
 	/* r &= 0xffffffc0ffffffc0ffffffc0fffffff */
@@ -495,7 +495,7 @@ static struct blkcipher_desc chacha20_desc = {
 
 bool chacha20poly1305_encrypt(uint8_t *dst, const uint8_t *src, const size_t src_len,
 			      const uint8_t *ad, const size_t ad_len,
-			      const uint64_t nonce, const uint8_t key[CHACHA20POLY1305_KEYLEN])
+			      const uint64_t nonce, const uint8_t key[static CHACHA20POLY1305_KEYLEN])
 {
 	struct poly1305_ctx poly1305_state;
 	struct chacha20_ctx chacha20_state;
@@ -545,7 +545,7 @@ bool chacha20poly1305_encrypt(uint8_t *dst, const uint8_t *src, const size_t src
 
 bool chacha20poly1305_encrypt_sg(struct scatterlist *dst, struct scatterlist *src, const size_t src_len,
 				 const uint8_t *ad, const size_t ad_len,
-				 const uint64_t nonce, const uint8_t key[CHACHA20POLY1305_KEYLEN])
+				 const uint64_t nonce, const uint8_t key[static CHACHA20POLY1305_KEYLEN])
 {
 	struct poly1305_ctx poly1305_state;
 	struct chacha20_ctx chacha20_state;
@@ -611,7 +611,7 @@ bool chacha20poly1305_encrypt_sg(struct scatterlist *dst, struct scatterlist *sr
 
 bool chacha20poly1305_decrypt(uint8_t *dst, const uint8_t *src, const size_t src_len,
 			      const uint8_t *ad, const size_t ad_len,
-			      const uint64_t nonce, const uint8_t key[CHACHA20POLY1305_KEYLEN])
+			      const uint64_t nonce, const uint8_t key[static CHACHA20POLY1305_KEYLEN])
 {
 	struct poly1305_ctx poly1305_state;
 	struct chacha20_ctx chacha20_state;
@@ -669,7 +669,7 @@ bool chacha20poly1305_decrypt(uint8_t *dst, const uint8_t *src, const size_t src
 
 bool chacha20poly1305_decrypt_sg(struct scatterlist *dst, struct scatterlist *src, const size_t src_len,
 				 const uint8_t *ad, const size_t ad_len,
-				 const uint64_t nonce, const uint8_t key[CHACHA20POLY1305_KEYLEN])
+				 const uint64_t nonce, const uint8_t key[static CHACHA20POLY1305_KEYLEN])
 {
 	struct poly1305_ctx poly1305_state;
 	struct chacha20_ctx chacha20_state;
diff --git a/src/crypto/chacha20poly1305.h b/src/crypto/chacha20poly1305.h
index d1986f7..71bd6bf 100644
--- a/src/crypto/chacha20poly1305.h
+++ b/src/crypto/chacha20poly1305.h
@@ -14,19 +14,19 @@ void chacha20poly1305_init(void);
 
 bool chacha20poly1305_encrypt(uint8_t *dst, const uint8_t *src, const size_t src_len,
 			      const uint8_t *ad, const size_t ad_len,
-			      const uint64_t nonce, const uint8_t key[CHACHA20POLY1305_KEYLEN]);
+			      const uint64_t nonce, const uint8_t key[static CHACHA20POLY1305_KEYLEN]);
 
 bool chacha20poly1305_encrypt_sg(struct scatterlist *dst, struct scatterlist *src, const size_t src_len,
 				 const uint8_t *ad, const size_t ad_len,
-				 const uint64_t nonce, const uint8_t key[CHACHA20POLY1305_KEYLEN]);
+				 const uint64_t nonce, const uint8_t key[static CHACHA20POLY1305_KEYLEN]);
 
 bool chacha20poly1305_decrypt(uint8_t *dst, const uint8_t *src, const size_t src_len,
 			      const uint8_t *ad, const size_t ad_len,
-			      const uint64_t nonce, const uint8_t key[CHACHA20POLY1305_KEYLEN]);
+			      const uint64_t nonce, const uint8_t key[static CHACHA20POLY1305_KEYLEN]);
 
 bool chacha20poly1305_decrypt_sg(struct scatterlist *dst, struct scatterlist *src, const size_t src_len,
 				 const uint8_t *ad, const size_t ad_len,
-				 const uint64_t nonce, const uint8_t key[CHACHA20POLY1305_KEYLEN]);
+				 const uint64_t nonce, const uint8_t key[static CHACHA20POLY1305_KEYLEN]);
 
 #ifdef DEBUG
 bool chacha20poly1305_selftest(void);
diff --git a/src/crypto/curve25519.c b/src/crypto/curve25519.c
index 021bbd1..10d514c 100644
--- a/src/crypto/curve25519.c
+++ b/src/crypto/curve25519.c
@@ -10,7 +10,7 @@
 #include <linux/random.h>
 #include <crypto/algapi.h>
 
-static __always_inline void normalize_secret(uint8_t secret[CURVE25519_POINT_SIZE])
+static __always_inline void normalize_secret(uint8_t secret[static CURVE25519_POINT_SIZE])
 {
 	secret[0] &= 248;
 	secret[31] &= 127;
@@ -300,7 +300,7 @@ static void fmonty(limb *x2, limb *z2, /* output 2Q */
  * This function performs the swap without leaking any side-channel
  * information.
  */
-static void swap_conditional(limb a[5], limb b[5], limb iswap)
+static void swap_conditional(limb a[static 5], limb b[static 5], limb iswap)
 {
 	unsigned i;
 	const limb swap = -iswap;
@@ -393,7 +393,7 @@ static void crecip(felem out, const felem z)
 	/* 2^255 - 21 */ fmul(out, t0, a);
 }
 
-void curve25519(uint8_t mypublic[CURVE25519_POINT_SIZE], const uint8_t secret[CURVE25519_POINT_SIZE], const uint8_t basepoint[CURVE25519_POINT_SIZE])
+void curve25519(uint8_t mypublic[static CURVE25519_POINT_SIZE], const uint8_t secret[static CURVE25519_POINT_SIZE], const uint8_t basepoint[static CURVE25519_POINT_SIZE])
 {
 	limb bp[5], x[5], z[5], zmone[5];
 	uint8_t e[32];
@@ -1071,7 +1071,7 @@ static void fmonty(limb *x2, limb *z2,  /* output 2Q */
  * reduced-degree form: the values in a[10..19] or b[10..19] aren't swapped,
  * and all all values in a[0..9],b[0..9] must have magnitude less than
  * INT32_MAX. */
-static void swap_conditional(limb a[19], limb b[19], limb iswap)
+static void swap_conditional(limb a[static 19], limb b[static 19], limb iswap)
 {
 	unsigned i;
 	const int32_t swap = (int32_t) -iswap;
@@ -1202,7 +1202,7 @@ static void crecip(limb *out, const limb *z)
 	/* 2^255 - 21 */ fmul(out,t1,z11);
 }
 
-void curve25519(uint8_t mypublic[CURVE25519_POINT_SIZE], const uint8_t secret[CURVE25519_POINT_SIZE], const uint8_t basepoint[CURVE25519_POINT_SIZE])
+void curve25519(uint8_t mypublic[static CURVE25519_POINT_SIZE], const uint8_t secret[static CURVE25519_POINT_SIZE], const uint8_t basepoint[static CURVE25519_POINT_SIZE])
 {
 	limb bp[10], x[10], z[11], zmone[10];
 	uint8_t e[32];
@@ -1225,13 +1225,13 @@ void curve25519(uint8_t mypublic[CURVE25519_POINT_SIZE], const uint8_t secret[CU
 #endif
 
 
-void curve25519_generate_secret(uint8_t secret[CURVE25519_POINT_SIZE])
+void curve25519_generate_secret(uint8_t secret[static CURVE25519_POINT_SIZE])
 {
 	get_random_bytes(secret, CURVE25519_POINT_SIZE);
 	normalize_secret(secret);
 }
 
-void curve25519_generate_public(uint8_t pub[CURVE25519_POINT_SIZE], const uint8_t secret[CURVE25519_POINT_SIZE])
+void curve25519_generate_public(uint8_t pub[static CURVE25519_POINT_SIZE], const uint8_t secret[static CURVE25519_POINT_SIZE])
 {
 	static const uint8_t basepoint[CURVE25519_POINT_SIZE] = { 9 };
 	curve25519(pub, secret, basepoint);
diff --git a/src/crypto/curve25519.h b/src/crypto/curve25519.h
index f16fc30..23f4d74 100644
--- a/src/crypto/curve25519.h
+++ b/src/crypto/curve25519.h
@@ -9,9 +9,9 @@ enum curve25519_lengths {
 	CURVE25519_POINT_SIZE = 32
 };
 
-void curve25519(uint8_t mypublic[CURVE25519_POINT_SIZE], const uint8_t secret[CURVE25519_POINT_SIZE], const uint8_t basepoint[CURVE25519_POINT_SIZE]);
-void curve25519_generate_secret(uint8_t secret[CURVE25519_POINT_SIZE]);
-void curve25519_generate_public(uint8_t pub[CURVE25519_POINT_SIZE], const uint8_t secret[CURVE25519_POINT_SIZE]);
+void curve25519(uint8_t mypublic[static CURVE25519_POINT_SIZE], const uint8_t secret[static CURVE25519_POINT_SIZE], const uint8_t basepoint[static CURVE25519_POINT_SIZE]);
+void curve25519_generate_secret(uint8_t secret[static CURVE25519_POINT_SIZE]);
+void curve25519_generate_public(uint8_t pub[static CURVE25519_POINT_SIZE], const uint8_t secret[static CURVE25519_POINT_SIZE]);
 
 #ifdef DEBUG
 bool curve25519_selftest(void);
diff --git a/src/crypto/siphash24.c b/src/crypto/siphash24.c
index 5a29a80..0023804 100644
--- a/src/crypto/siphash24.c
+++ b/src/crypto/siphash24.c
@@ -16,7 +16,7 @@
 	} while(0)
 
 __attribute__((optimize("unroll-loops")))
-uint64_t siphash24(const uint8_t *data, size_t len, const uint8_t key[SIPHASH24_KEY_LEN])
+uint64_t siphash24(const uint8_t *data, size_t len, const uint8_t key[static SIPHASH24_KEY_LEN])
 {
 	uint64_t v0 = 0x736f6d6570736575ULL;
 	uint64_t v1 = 0x646f72616e646f6dULL;
diff --git a/src/crypto/siphash24.h b/src/crypto/siphash24.h
index f06a87c..ec893bd 100644
--- a/src/crypto/siphash24.h
+++ b/src/crypto/siphash24.h
@@ -7,7 +7,7 @@ enum siphash24_lengths {
 	SIPHASH24_KEY_LEN = 16
 };
 
-uint64_t siphash24(const uint8_t *data, size_t len, const uint8_t key[SIPHASH24_KEY_LEN]);
+uint64_t siphash24(const uint8_t *data, size_t len, const uint8_t key[static SIPHASH24_KEY_LEN]);
 
 #ifdef DEBUG
 bool siphash24_selftest(void);
diff --git a/src/hashtables.c b/src/hashtables.c
index db7c23b..965605b 100644
--- a/src/hashtables.c
+++ b/src/hashtables.c
@@ -7,7 +7,7 @@
 #include "noise.h"
 #include <linux/hashtable.h>
 
-static inline struct hlist_head *pubkey_bucket(struct pubkey_hashtable *table, const uint8_t pubkey[NOISE_PUBLIC_KEY_LEN])
+static inline struct hlist_head *pubkey_bucket(struct pubkey_hashtable *table, const uint8_t pubkey[static NOISE_PUBLIC_KEY_LEN])
 {
 	/* siphash24 gives us a secure 64bit number based on a random key. Since the bits are
 	 * uniformly distributed, we can then mask off to get the bits we need. */
@@ -36,7 +36,7 @@ void pubkey_hashtable_remove(struct pubkey_hashtable *table, struct wireguard_pe
 }
 
 /* Returns a strong reference to a peer */
-struct wireguard_peer *pubkey_hashtable_lookup(struct pubkey_hashtable *table, const uint8_t pubkey[NOISE_PUBLIC_KEY_LEN])
+struct wireguard_peer *pubkey_hashtable_lookup(struct pubkey_hashtable *table, const uint8_t pubkey[static NOISE_PUBLIC_KEY_LEN])
 {
 	struct wireguard_peer *iter_peer, *peer = NULL;
 	rcu_read_lock();
diff --git a/src/hashtables.h b/src/hashtables.h
index ed9506b..d51c0d8 100644
--- a/src/hashtables.h
+++ b/src/hashtables.h
@@ -16,7 +16,7 @@ struct pubkey_hashtable {
 void pubkey_hashtable_init(struct pubkey_hashtable *table);
 void pubkey_hashtable_add(struct pubkey_hashtable *table, struct wireguard_peer *peer);
 void pubkey_hashtable_remove(struct pubkey_hashtable *table, struct wireguard_peer *peer);
-struct wireguard_peer *pubkey_hashtable_lookup(struct pubkey_hashtable *table, const uint8_t pubkey[NOISE_PUBLIC_KEY_LEN]);
+struct wireguard_peer *pubkey_hashtable_lookup(struct pubkey_hashtable *table, const uint8_t pubkey[static NOISE_PUBLIC_KEY_LEN]);
 
 struct index_hashtable {
 	DECLARE_HASHTABLE(hashtable, 10);
diff --git a/src/noise.c b/src/noise.c
index fd8e7d8..c505a72 100644
--- a/src/noise.c
+++ b/src/noise.c
@@ -33,7 +33,7 @@ void noise_init(void)
 	blake2s(handshake_psk_name_hash, handshake_psk_name, NULL, NOISE_HASH_LEN, sizeof(handshake_psk_name), 0);
 }
 
-void noise_handshake_init(struct noise_handshake *handshake, struct noise_static_identity *static_identity, const u8 peer_public_key[NOISE_PUBLIC_KEY_LEN], struct wireguard_peer *peer)
+void noise_handshake_init(struct noise_handshake *handshake, struct noise_static_identity *static_identity, const u8 peer_public_key[static NOISE_PUBLIC_KEY_LEN], struct wireguard_peer *peer)
 {
 	memset(handshake, 0, sizeof(struct noise_handshake));
 	init_rwsem(&handshake->lock);
@@ -156,7 +156,7 @@ bool noise_received_with_keypair(struct noise_keypairs *keypairs, struct noise_k
 	return ret;
 }
 
-void noise_set_static_identity_private_key(struct noise_static_identity *static_identity, const u8 private_key[NOISE_PUBLIC_KEY_LEN])
+void noise_set_static_identity_private_key(struct noise_static_identity *static_identity, const u8 private_key[static NOISE_PUBLIC_KEY_LEN])
 {
 	down_write(&static_identity->lock);
 	if (private_key) {
@@ -171,7 +171,7 @@ void noise_set_static_identity_private_key(struct noise_static_identity *static_
 	up_write(&static_identity->lock);
 }
 
-void noise_set_static_identity_preshared_key(struct noise_static_identity *static_identity, const u8 preshared_key[NOISE_SYMMETRIC_KEY_LEN])
+void noise_set_static_identity_preshared_key(struct noise_static_identity *static_identity, const u8 preshared_key[static NOISE_SYMMETRIC_KEY_LEN])
 {
 	down_write(&static_identity->lock);
 	if (preshared_key) {
@@ -190,7 +190,7 @@ void noise_set_static_identity_preshared_key(struct noise_static_identity *stati
  */
 static void kdf(u8 *first_dst, u8 *second_dst, const u8 *data,
 		size_t first_len, size_t second_len, size_t data_len,
-		const u8 chaining_key[NOISE_HASH_LEN])
+		const u8 chaining_key[static NOISE_HASH_LEN])
 {
 	u8 secret[BLAKE2S_OUTBYTES];
 	u8 output[BLAKE2S_OUTBYTES + 1];
@@ -223,20 +223,20 @@ static void symmetric_key_init(struct noise_symmetric_key *key)
 	key->is_valid = true;
 }
 
-static void derive_keys(struct noise_symmetric_key *first_dst, struct noise_symmetric_key *second_dst, const u8 chaining_key[NOISE_HASH_LEN])
+static void derive_keys(struct noise_symmetric_key *first_dst, struct noise_symmetric_key *second_dst, const u8 chaining_key[static NOISE_HASH_LEN])
 {
 	kdf(first_dst->key, second_dst->key, NULL, NOISE_SYMMETRIC_KEY_LEN, NOISE_SYMMETRIC_KEY_LEN, 0, chaining_key);
 	symmetric_key_init(first_dst);
 	symmetric_key_init(second_dst);
 }
 
-static void mix_key(u8 key[NOISE_SYMMETRIC_KEY_LEN], u8 chaining_key[NOISE_HASH_LEN], const u8 *src, size_t src_len)
+static void mix_key(u8 key[static NOISE_SYMMETRIC_KEY_LEN], u8 chaining_key[static NOISE_HASH_LEN], const u8 *src, size_t src_len)
 {
 	kdf(chaining_key, key, src, NOISE_HASH_LEN, NOISE_SYMMETRIC_KEY_LEN, src_len, chaining_key);
 }
 
-static void mix_dh(u8 key[NOISE_SYMMETRIC_KEY_LEN], u8 chaining_key[NOISE_HASH_LEN],
-		   const u8 private[NOISE_PUBLIC_KEY_LEN], const u8 public[NOISE_PUBLIC_KEY_LEN])
+static void mix_dh(u8 key[static NOISE_SYMMETRIC_KEY_LEN], u8 chaining_key[static NOISE_HASH_LEN],
+		   const u8 private[static NOISE_PUBLIC_KEY_LEN], const u8 public[static NOISE_PUBLIC_KEY_LEN])
 {
 	u8 dh_calculation[NOISE_PUBLIC_KEY_LEN];
 	curve25519(dh_calculation, private, public);
@@ -244,7 +244,7 @@ static void mix_dh(u8 key[NOISE_SYMMETRIC_KEY_LEN], u8 chaining_key[NOISE_HASH_L
 	memzero_explicit(dh_calculation, NOISE_PUBLIC_KEY_LEN);
 }
 
-static void mix_hash(u8 hash[NOISE_HASH_LEN], const u8 *src, size_t src_len)
+static void mix_hash(u8 hash[static NOISE_HASH_LEN], const u8 *src, size_t src_len)
 {
 	struct blake2s_state blake;
 	blake2s_init(&blake, NOISE_HASH_LEN);
@@ -253,8 +253,8 @@ static void mix_hash(u8 hash[NOISE_HASH_LEN], const u8 *src, size_t src_len)
 	blake2s_final(&blake, hash, NOISE_HASH_LEN);
 }
 
-static void handshake_init(u8 key[NOISE_SYMMETRIC_KEY_LEN], u8 chaining_key[NOISE_HASH_LEN], u8 hash[NOISE_HASH_LEN],
-			   const u8 remote_static[NOISE_PUBLIC_KEY_LEN], const u8 psk[NOISE_SYMMETRIC_KEY_LEN])
+static void handshake_init(u8 key[static NOISE_SYMMETRIC_KEY_LEN], u8 chaining_key[static NOISE_HASH_LEN], u8 hash[static NOISE_HASH_LEN],
+			   const u8 remote_static[static NOISE_PUBLIC_KEY_LEN], const u8 psk[static NOISE_SYMMETRIC_KEY_LEN])
 {
 	memset(key, 0, NOISE_SYMMETRIC_KEY_LEN);
 	memcpy(hash, psk ? handshake_psk_name_hash : handshake_name_hash, NOISE_HASH_LEN);
@@ -269,7 +269,7 @@ static void handshake_init(u8 key[NOISE_SYMMETRIC_KEY_LEN], u8 chaining_key[NOIS
 	mix_hash(hash, remote_static, NOISE_PUBLIC_KEY_LEN);
 }
 
-static bool handshake_encrypt(u8 *dst_ciphertext, const u8 *src_plaintext, size_t src_len, u8 key[NOISE_SYMMETRIC_KEY_LEN], u8 hash[NOISE_HASH_LEN])
+static bool handshake_encrypt(u8 *dst_ciphertext, const u8 *src_plaintext, size_t src_len, u8 key[static NOISE_SYMMETRIC_KEY_LEN], u8 hash[static NOISE_HASH_LEN])
 {
 	if (!chacha20poly1305_encrypt(dst_ciphertext, src_plaintext, src_len, hash, NOISE_HASH_LEN, 0 /* Always zero for Noise_IK */, key))
 		return false;
@@ -277,7 +277,7 @@ static bool handshake_encrypt(u8 *dst_ciphertext, const u8 *src_plaintext, size_
 	return true;
 }
 
-static bool handshake_decrypt(u8 *dst_plaintext, const u8 *src_ciphertext, size_t src_len, u8 key[NOISE_SYMMETRIC_KEY_LEN], u8 hash[NOISE_HASH_LEN])
+static bool handshake_decrypt(u8 *dst_plaintext, const u8 *src_ciphertext, size_t src_len, u8 key[static NOISE_SYMMETRIC_KEY_LEN], u8 hash[static NOISE_HASH_LEN])
 {
 	if (!chacha20poly1305_decrypt(dst_plaintext, src_ciphertext, src_len, hash, NOISE_HASH_LEN, 0 /* Always zero for Noise_IK */, key))
 		return false;
@@ -285,13 +285,13 @@ static bool handshake_decrypt(u8 *dst_plaintext, const u8 *src_ciphertext, size_
 	return true;
 }
 
-static void handshake_nocrypt(u8 *dst, const u8 *src, size_t src_len, u8 hash[NOISE_HASH_LEN])
+static void handshake_nocrypt(u8 *dst, const u8 *src, size_t src_len, u8 hash[static NOISE_HASH_LEN])
 {
 	memcpy(dst, src, src_len);
 	mix_hash(hash, src, src_len);
 }
 
-static void tai64n_now(u8 output[NOISE_TIMESTAMP_LEN])
+static void tai64n_now(u8 output[static NOISE_TIMESTAMP_LEN])
 {
 	struct timeval now;
 	do_gettimeofday(&now);
diff --git a/src/noise.h b/src/noise.h
index 289f60b..9ae3c85 100644
--- a/src/noise.h
+++ b/src/noise.h
@@ -139,14 +139,14 @@ struct message_data;
 struct message_handshake_cookie;
 
 void noise_init(void);
-void noise_handshake_init(struct noise_handshake *handshake, struct noise_static_identity *static_identity, const u8 peer_public_key[NOISE_PUBLIC_KEY_LEN], struct wireguard_peer *peer);
+void noise_handshake_init(struct noise_handshake *handshake, struct noise_static_identity *static_identity, const u8 peer_public_key[static NOISE_PUBLIC_KEY_LEN], struct wireguard_peer *peer);
 void noise_handshake_clear(struct noise_handshake *handshake);
 void noise_keypair_put(struct noise_keypair *keypair);
 void noise_keypairs_clear(struct noise_keypairs *keypairs);
 bool noise_received_with_keypair(struct noise_keypairs *keypairs, struct noise_keypair *received_keypair);
 
-void noise_set_static_identity_private_key(struct noise_static_identity *static_identity, const u8 private_key[NOISE_PUBLIC_KEY_LEN]);
-void noise_set_static_identity_preshared_key(struct noise_static_identity *static_identity, const u8 preshared_key[NOISE_SYMMETRIC_KEY_LEN]);
+void noise_set_static_identity_private_key(struct noise_static_identity *static_identity, const u8 private_key[static NOISE_PUBLIC_KEY_LEN]);
+void noise_set_static_identity_preshared_key(struct noise_static_identity *static_identity, const u8 preshared_key[static NOISE_SYMMETRIC_KEY_LEN]);
 
 bool noise_handshake_create_initiation(struct message_handshake_initiation *dst, struct noise_handshake *handshake);
 struct wireguard_peer *noise_handshake_consume_initiation(struct message_handshake_initiation *src, struct wireguard_device *wg);
diff --git a/src/peer.c b/src/peer.c
index ad48a4e..4baed0b 100644
--- a/src/peer.c
+++ b/src/peer.c
@@ -13,7 +13,7 @@
 
 static atomic64_t peer_counter = ATOMIC64_INIT(0);
 
-struct wireguard_peer *peer_create(struct wireguard_device *wg, const u8 public_key[NOISE_PUBLIC_KEY_LEN])
+struct wireguard_peer *peer_create(struct wireguard_device *wg, const u8 public_key[static NOISE_PUBLIC_KEY_LEN])
 {
 	struct wireguard_peer *peer;
 	lockdep_assert_held(&wg->device_update_lock);
diff --git a/src/peer.h b/src/peer.h
index 47534a2..580d295 100644
--- a/src/peer.h
+++ b/src/peer.h
@@ -39,7 +39,7 @@ struct wireguard_peer {
 	uint64_t internal_id;
 };
 
-struct wireguard_peer *peer_create(struct wireguard_device *wg, const u8 public_key[NOISE_PUBLIC_KEY_LEN]);
+struct wireguard_peer *peer_create(struct wireguard_device *wg, const u8 public_key[static NOISE_PUBLIC_KEY_LEN]);
 
 struct wireguard_peer *peer_get(struct wireguard_peer *peer);
 void peer_put(struct wireguard_peer *peer);
diff --git a/src/tools/config.c b/src/tools/config.c
index 611207e..55a8ab5 100644
--- a/src/tools/config.c
+++ b/src/tools/config.c
@@ -90,7 +90,7 @@ static inline uint16_t parse_port(const char *value)
 	return port;
 }
 
-static inline bool parse_key(uint8_t key[WG_KEY_LEN], const char *value)
+static inline bool parse_key(uint8_t key[static WG_KEY_LEN], const char *value)
 {
 	uint8_t tmp[WG_KEY_LEN + 1];
 	if (strlen(value) != b64_len(WG_KEY_LEN) - 1 || b64_pton(value, tmp, WG_KEY_LEN + 1) != WG_KEY_LEN) {
diff --git a/src/tools/curve25519.c b/src/tools/curve25519.c
index 6c26535..3d0b615 100644
--- a/src/tools/curve25519.c
+++ b/src/tools/curve25519.c
@@ -337,7 +337,7 @@ static void fmonty(limb *x2, limb *z2, /* output 2Q */
  * This function performs the swap without leaking any side-channel
  * information.
  */
-static void swap_conditional(limb a[5], limb b[5], limb iswap)
+static void swap_conditional(limb a[static 5], limb b[static 5], limb iswap)
 {
 	unsigned i;
 	const limb swap = -iswap;
@@ -430,7 +430,7 @@ static void crecip(felem out, const felem z)
 	/* 2^255 - 21 */ fmul(out, t0, a);
 }
 
-void curve25519(uint8_t mypublic[CURVE25519_POINT_SIZE], const uint8_t secret[CURVE25519_POINT_SIZE], const uint8_t basepoint[CURVE25519_POINT_SIZE])
+void curve25519(uint8_t mypublic[static CURVE25519_POINT_SIZE], const uint8_t secret[static CURVE25519_POINT_SIZE], const uint8_t basepoint[static CURVE25519_POINT_SIZE])
 {
 	limb bp[5], x[5], z[5], zmone[5];
 	uint8_t e[32];
@@ -1104,7 +1104,7 @@ static void fmonty(limb *x2, limb *z2,  /* output 2Q */
  * reduced-degree form: the values in a[10..19] or b[10..19] aren't swapped,
  * and all all values in a[0..9],b[0..9] must have magnitude less than
  * INT32_MAX. */
-static void swap_conditional(limb a[19], limb b[19], limb iswap)
+static void swap_conditional(limb a[static 19], limb b[static 19], limb iswap)
 {
 	unsigned i;
 	const int32_t swap = (int32_t) -iswap;
@@ -1235,7 +1235,7 @@ static void crecip(limb *out, const limb *z)
 	/* 2^255 - 21 */ fmul(out,t1,z11);
 }
 
-void curve25519(uint8_t mypublic[CURVE25519_POINT_SIZE], const uint8_t secret[CURVE25519_POINT_SIZE], const uint8_t basepoint[CURVE25519_POINT_SIZE])
+void curve25519(uint8_t mypublic[static CURVE25519_POINT_SIZE], const uint8_t secret[static CURVE25519_POINT_SIZE], const uint8_t basepoint[static CURVE25519_POINT_SIZE])
 {
 	limb bp[10], x[10], z[11], zmone[10];
 	uint8_t e[32];
@@ -1251,7 +1251,7 @@ void curve25519(uint8_t mypublic[CURVE25519_POINT_SIZE], const uint8_t secret[CU
 }
 #endif
 
-void curve25519_generate_public(uint8_t *pub, const uint8_t *secret)
+void curve25519_generate_public(uint8_t pub[static CURVE25519_POINT_SIZE], const uint8_t secret[static CURVE25519_POINT_SIZE])
 {
 	static const uint8_t basepoint[CURVE25519_POINT_SIZE] = { 9 };
 	curve25519(pub, secret, basepoint);
diff --git a/src/tools/curve25519.h b/src/tools/curve25519.h
index 3c1404a..0be59b7 100644
--- a/src/tools/curve25519.h
+++ b/src/tools/curve25519.h
@@ -10,9 +10,9 @@ enum curve25519_lengths {
 	CURVE25519_POINT_SIZE = 32,
 };
 
-void curve25519(uint8_t *mypublic, const uint8_t *secret, const uint8_t *basepoint);
-void curve25519_generate_public(uint8_t *pub, const uint8_t *secret);
-static inline void curve25519_normalize_secret(uint8_t secret[CURVE25519_POINT_SIZE])
+void curve25519(uint8_t mypublic[static CURVE25519_POINT_SIZE], const uint8_t secret[static CURVE25519_POINT_SIZE], const uint8_t basepoint[static CURVE25519_POINT_SIZE]);
+void curve25519_generate_public(uint8_t pub[static CURVE25519_POINT_SIZE], const uint8_t secret[static CURVE25519_POINT_SIZE]);
+static inline void curve25519_normalize_secret(uint8_t secret[static CURVE25519_POINT_SIZE])
 {
 	secret[0] &= 248;
 	secret[31] &= 127;
diff --git a/src/tools/show.c b/src/tools/show.c
index ddda6c3..3a32cb8 100644
--- a/src/tools/show.c
+++ b/src/tools/show.c
@@ -78,7 +78,7 @@ static void sort_peers(struct wgdevice *device)
 
 static const uint8_t zero[WG_KEY_LEN] = { 0 };
 
-static char *key(const unsigned char key[WG_KEY_LEN])
+static char *key(const unsigned char key[static WG_KEY_LEN])
 {
 	static char b64[b64_len(WG_KEY_LEN)];
 	if (!memcmp(key, zero, WG_KEY_LEN))