diff options
| -rw-r--r-- | util/nvmutil/nvmutil.c | 350 |
1 files changed, 214 insertions, 136 deletions
diff --git a/util/nvmutil/nvmutil.c b/util/nvmutil/nvmutil.c index aecd2067..68e041a3 100644 --- a/util/nvmutil/nvmutil.c +++ b/util/nvmutil/nvmutil.c @@ -89,10 +89,22 @@ typedef char static_assert_off_t_is_32[(sizeof(off_t) >= 4) ? 1 : -1]; #endif #endif +#ifndef EXIT_FAILURE +#define EXIT_FAILURE 1 +#endif + +#ifndef EXIT_SUCCESS +#define EXIT_SUCCESS 0 +#endif + #ifndef O_BINARY #define O_BINARY 0 #endif +#ifndef O_NONBLOCK +#define O_NONBLOCK 0 +#endif + /* * Sanitize command tables. */ @@ -197,11 +209,13 @@ static uint8_t *gbe_mem_offset(size_t part, const char *f_op); static off_t gbe_file_offset(size_t part, const char *f_op); static off_t gbe_x_offset(size_t part, const char *f_op, const char *d_type, off_t nsize, off_t ncmp); -static void rw_file_exact(int fd, uint8_t *mem, size_t len, - off_t off, int rw_type, const char *path, const char *rw_type_str); -static ssize_t prw(int fd, void *mem, size_t count, - off_t offset, int rw_type, const char *path); -static off_t lseek_eintr(int fd, off_t offset, int whence); +static ssize_t rw_file_exact(int fd, uint8_t *mem, size_t len, + off_t off, int rw_type); +static ssize_t do_rw(int fd, + uint8_t *mem, size_t len, off_t off, int rw_type); +static ssize_t prw(int fd, void *mem, size_t nrw, + off_t off, int rw_type); +static off_t lseek_eintr(int fd, off_t off, int whence); /* * Error handling and cleanup @@ -209,7 +223,7 @@ static off_t lseek_eintr(int fd, off_t offset, int whence); static void err(int nvm_errval, const char *msg, ...); static void close_files(void); static const char *getnvmprogname(void); -static void set_err(int errval); +static void set_err_if_unset(int errval); static void usage(uint8_t usage_exit); /* @@ -265,7 +279,6 @@ static uint8_t pad[GBE_PART_SIZE]; /* the file that wouldn't die */ static uint16_t mac_buf[3]; static off_t gbe_file_size; -static struct stat gbe_st; static int urandom_fd = -1; static int gbe_fd = -1; static size_t part; @@ -277,12 +290,8 @@ static const char *mac_str; static const char *fname; static const char *argv0; -#ifndef SIZE_MAX -#define SIZE_MAX ((size_t)-1) -#endif - #ifndef SSIZE_MAX -#define SSIZE_MAX ((ssize_t)(SIZE_MAX >> 1)) +#define SSIZE_MAX ((ssize_t)(~((size_t)1 << (sizeof(ssize_t)*CHAR_BIT-1)))) #endif /* @@ -423,6 +432,9 @@ static const struct commands command[] = { */ static size_t cmd_index = CMD_NULL; +typedef char assert_argc3[(ARGC_3==3)?1:-1]; +typedef char assert_argc4[(ARGC_4==4)?1:-1]; + int main(int argc, char *argv[]) { @@ -435,12 +447,12 @@ main(int argc, char *argv[]) #ifdef NVMUTIL_PLEDGE #ifdef NVMUTIL_UNVEIL if (pledge("stdio rpath wpath unveil", NULL) == -1) - err(ECANCELED, "pledge"); + err(errno, "pledge"); if (unveil("/dev/null", "r") == -1) - err(ECANCELED, "unveil '/dev/null'"); + err(errno, "unveil '/dev/null'"); #else if (pledge("stdio rpath wpath", NULL) == -1) - err(ECANCELED, "pledge"); + err(errno, "pledge"); #endif #endif @@ -453,23 +465,23 @@ main(int argc, char *argv[]) #ifdef NVMUTIL_UNVEIL if (command[cmd_index].flags == O_RDONLY) { if (unveil(fname, "r") == -1) - err(ECANCELED, "%s: unveil ro", fname); + err(errno, "%s: unveil ro", fname); if (unveil(NULL, NULL) == -1) - err(ECANCELED, "unveil block (ro)"); + err(errno, "unveil block (ro)"); if (pledge("stdio rpath", NULL) == -1) - err(ECANCELED, "pledge ro (kill unveil)"); + err(errno, "pledge ro (kill unveil)"); } else { if (unveil(fname, "rw") == -1) - err(ECANCELED, "%s: unveil rw", fname); + err(errno, "%s: unveil rw", fname); if (unveil(NULL, NULL) == -1) - err(ECANCELED, "unveil block (rw)"); + err(errno, "unveil block (rw)"); if (pledge("stdio rpath wpath", NULL) == -1) - err(ECANCELED, "pledge rw (kill unveil)"); + err(errno, "pledge rw (kill unveil)"); } #else if (command[cmd_index].flags == O_RDONLY) { if (pledge("stdio rpath", NULL) == -1) - err(ECANCELED, "pledge ro"); + err(errno, "pledge ro"); } #endif #endif @@ -480,7 +492,7 @@ main(int argc, char *argv[]) #ifdef NVMUTIL_PLEDGE if (pledge("stdio", NULL) == -1) - err(ECANCELED, "pledge stdio (main)"); + err(errno, "pledge stdio (main)"); #endif /* @@ -494,15 +506,16 @@ main(int argc, char *argv[]) errno = 0; run_cmd(cmd_index); - if (errno) + if (errno && (!(part_valid[0] || part_valid[1]))) err(errno, "%s: Unhandled error (WRITE SKIPPED)", fname); - else if (command[cmd_index].flags == O_RDWR) + + if (command[cmd_index].flags == O_RDWR) write_gbe_file(); close_files(); if (errno) - err(ECANCELED, "Unhandled error on exit"); + err(errno, "Unhandled error on exit"); return EXIT_SUCCESS; } @@ -515,7 +528,7 @@ sanitize_command_list(void) { size_t c; - for (c = 0; valid_command(c); c++) + for (c = 0; c < N_COMMANDS; c++) sanitize_command_index(c); } @@ -527,28 +540,32 @@ sanitize_command_index(size_t c) check_command_num(c); - if (ARGC_3 != 3) - err(ECANCELED, "ARGC_3 is not equal to 3"); - if (ARGC_4 != 4) - err(ECANCELED, "ARGC_4 is not equal to 4"); - if (command[c].argc < 3) - err(ECANCELED, "cmd index %lu: argc below 3, %d", + err(EINVAL, "cmd index %lu: argc below 3, %d", (unsigned long)c, command[c].argc); if (command[c].str == NULL) - err(ECANCELED, "cmd index %lu: NULL str", + err(EINVAL, "cmd index %lu: NULL str", (unsigned long)c); if (*command[c].str == '\0') - err(ECANCELED, "cmd index %lu: empty str", + err(EINVAL, "cmd index %lu: empty str", (unsigned long)c); if (xstrxlen(command[c].str, MAX_CMD_LEN + 1) > MAX_CMD_LEN) { - err(ECANCELED, "cmd index %lu: str too long: %s", + err(EINVAL, "cmd index %lu: str too long: %s", (unsigned long)c, command[c].str); } + if (!((CMD_SETMAC > CMD_DUMP) && (CMD_SWAP > CMD_SETMAC) && + (CMD_COPY > CMD_SWAP) && (CMD_CAT > CMD_COPY) && + (CMD_CAT16 > CMD_CAT) && (CMD_CAT128 > CMD_CAT16))) + err(EINVAL, "Some command integers are the same"); + + if (!((SET_MOD_0 > SET_MOD_OFF) && (SET_MOD_1 > SET_MOD_0) && + (SET_MOD_N > SET_MOD_1) && (SET_MOD_BOTH > SET_MOD_N))) + err(EINVAL, "Some modtype integers are the same"); + mod_type = command[c].set_modified; switch (mod_type) { case SET_MOD_0: @@ -571,6 +588,7 @@ sanitize_command_index(size_t c) CHECKSUM_READ, "CHECKSUM_READ"); check_enum_bin(SKIP_CHECKSUM_WRITE, "SKIP_CHECKSUM_WRITE", CHECKSUM_WRITE, "CHECKSUM_WRITE"); + check_enum_bin(NO_INVERT, "NO_INVERT", PART_INVERT, "PART_INVERT"); gbe_rw_size = command[c].rw_size; @@ -591,8 +609,8 @@ sanitize_command_index(size_t c) command[c].flags != O_RDWR) err(EINVAL, "invalid cmd.flags setting"); - if (!((PLESEN > LESEN) && (SCHREIB > PLESEN) && (PSCHREIB > SCHREIB))) - err(EINVAL, "some rw type integers are the same"); + if (!((!LESEN) && (PLESEN == 1) && (SCHREIB == 2) && (PSCHREIB == 3))) + err(EINVAL, "rw type integers are the wrong values"); } static void @@ -600,10 +618,10 @@ check_enum_bin(size_t a, const char *a_name, size_t b, const char *b_name) { if (a) - err(ECANCELED, "%s is non-zero", a_name); + err(EINVAL, "%s is non-zero", a_name); if (b != 1) - err(ECANCELED, "%s is a value other than 1", b_name); + err(EINVAL, "%s is a value other than 1", b_name); } static void @@ -637,10 +655,10 @@ set_cmd_args(int argc, char *argv[]) /* Maintainer bugs */ if (arg_part && argc < 4) - err(ECANCELED, + err(EINVAL, "arg_part set for command that needs argc4"); if (arg_part && cmd_index == CMD_SETMAC) - err(ECANCELED, + err(EINVAL, "arg_part set on CMD_SETMAC"); if (cmd_index == CMD_SETMAC) @@ -696,7 +714,7 @@ xstrxcmp(const char *a, const char *b, size_t maxlen) /* * Should never reach here. This keeps compilers happy. */ - errno = EINVAL; + set_err_if_unset(EINVAL); return -1; } @@ -704,11 +722,15 @@ static void open_dev_urandom(void) { rname = newrandom; - if ((urandom_fd = open(rname, O_RDONLY | O_BINARY)) != -1) + urandom_fd = open(rname, O_RDONLY | O_BINARY | O_NONBLOCK); + if (urandom_fd != -1) return; /* * Fall back to /dev/random on very old Unix. + * + * We must reset errno, to remove stale state + * set by reading /dev/urandom */ fprintf(stderr, "Can't open %s (will use %s instead)\n", @@ -717,12 +739,16 @@ open_dev_urandom(void) errno = 0; rname = oldrandom; - xopen(&urandom_fd, rname, O_RDONLY | O_BINARY, &gbe_st); + urandom_fd = open(rname, O_RDONLY | O_BINARY | O_NONBLOCK); + if (urandom_fd == -1) + err(errno, "%s: could not open", rname); } static void open_gbe_file(void) { + struct stat gbe_st; + xopen(&gbe_fd, fname, command[cmd_index].flags | O_BINARY, &gbe_st); gbe_file_size = gbe_st.st_size; @@ -733,7 +759,7 @@ open_gbe_file(void) case SIZE_128KB: break; default: - err(ECANCELED, "File size must be 8KB, 16KB or 128KB"); + err(EINVAL, "File size must be 8KB, 16KB or 128KB"); } } @@ -741,13 +767,13 @@ static void xopen(int *fd_ptr, const char *path, int flags, struct stat *st) { if ((*fd_ptr = open(path, flags)) == -1) - err(ECANCELED, "%s", path); + err(errno, "%s", path); if (fstat(*fd_ptr, st) == -1) - err(ECANCELED, "%s", path); + err(errno, "%s", path); if (!S_ISREG(st->st_mode)) - err(ECANCELED, "%s: not a regular file", path); + err(errno, "%s: not a regular file", path); } static void @@ -816,9 +842,9 @@ read_checksums(void) if (num_invalid >= max_invalid) { if (max_invalid == 1) - err(ECANCELED, "%s: part %lu has a bad checksum", + err(EINVAL, "%s: part %lu has a bad checksum", fname, (unsigned long)part); - err(ECANCELED, "%s: No valid checksum found in file", + err(EINVAL, "%s: No valid checksum found in file", fname); } } @@ -832,7 +858,7 @@ good_checksum(size_t partnum) if (current_checksum == expected_checksum) return 1; - set_err(ECANCELED); + set_err_if_unset(EINVAL); return 0; } @@ -848,7 +874,7 @@ static void check_command_num(size_t c) { if (!valid_command(c)) - err(ECANCELED, "Invalid run_cmd arg: %lu", + err(errno, "Invalid run_cmd arg: %lu", (unsigned long)c); } @@ -859,7 +885,7 @@ valid_command(size_t c) return 0; if (c != command[c].chk) - err(ECANCELED, "Invalid cmd chk value (%lu) vs arg: %lu", + err(EINVAL, "Invalid cmd chk value (%lu) vs arg: %lu", (unsigned long)command[c].chk, (unsigned long)c); return 1; @@ -998,7 +1024,9 @@ rhex(void) if (!n) { n = sizeof(rnum); - rw_file_exact(urandom_fd, rnum, n, 0, LESEN, rname, "read"); + if (rw_file_exact(urandom_fd, rnum, n, 0, LESEN) == -1) + err(errno, "Randomisation failed"); + errno = 0; } return (uint16_t)(rnum[--n] & 0xf); @@ -1093,7 +1121,7 @@ cmd_helper_cat(void) else if (cmd_index == CMD_CAT128) n = 15; else if (cmd_index != CMD_CAT) - err(ECANCELED, "cmd_helper_cat called erroneously"); + err(EINVAL, "cmd_helper_cat called erroneously"); fflush(NULL); @@ -1108,8 +1136,38 @@ cmd_helper_cat(void) static void gbe_cat_buf(uint8_t *b) { - rw_file_exact(STDOUT_FILENO, b, GBE_PART_SIZE, 0, - SCHREIB, "stdout", "write"); + ssize_t rval; + + while (1) { + rval = rw_file_exact(STDOUT_FILENO, b, + GBE_PART_SIZE, 0, SCHREIB); + + if (rval >= 0) { + /* + * A partial write is especially + * fatal, as it should already be + * prevented in rw_file_exact(). + */ + if ((size_t)rval != GBE_PART_SIZE) + err(EIO, "stdout: cat: Partial write"); + break; + } + + if (errno != EAGAIN) + err(errno, "stdout: cat"); + + /* + * We assume that no data + * was written to stdout. + */ + errno = 0; + } + + /* + * No errors here. + * Avoid the warning in main() + */ + errno = 0; } static void @@ -1238,7 +1296,7 @@ check_nvm_bound(size_t c, size_t p) check_bin(p, "part number"); if (c >= NVM_WORDS) - err(EINVAL, "check_nvm_bound: out of bounds %lu", + err(ECANCELED, "check_nvm_bound: out of bounds %lu", (unsigned long)c); } @@ -1246,7 +1304,7 @@ static void check_bin(size_t a, const char *a_name) { if (a > 1) - err(ECANCELED, "%s must be 0 or 1, but is %lu", + err(EINVAL, "%s must be 0 or 1, but is %lu", a_name, (unsigned long)a); } @@ -1268,9 +1326,13 @@ rw_gbe_file_part(size_t p, int rw_type, */ mem_offset = gbe_mem_offset(p ^ invert, rw_type_str); - rw_file_exact(gbe_fd, mem_offset, + if (rw_file_exact(gbe_fd, mem_offset, gbe_rw_size, gbe_file_offset(p, rw_type_str), - rw_type, fname, rw_type_str); + rw_type) == -1) + err(errno, "%s: %s: part %lu", + fname, rw_type_str, (unsigned long)p); + + errno = 0; } /* @@ -1288,8 +1350,7 @@ gbe_mem_offset(size_t p, const char *f_op) } /* - * Reads to GbE from write_gbe_file_part and read_gbe_file_part - * are filtered through here. These operations must + * I/O operations filtered here. These operations must * only write from the 0th position or the half position * within the GbE file, and write 4KB of data. * @@ -1314,7 +1375,7 @@ gbe_x_offset(size_t p, const char *f_op, const char *d_type, off = ((off_t)p) * (off_t)nsize; - if (off + GBE_PART_SIZE > ncmp) + if (off > ncmp - GBE_PART_SIZE) err(ECANCELED, "%s: GbE %s %s out of bounds", fname, d_type, f_op); @@ -1325,109 +1386,117 @@ gbe_x_offset(size_t p, const char *f_op, const char *d_type, return off; } -static void +/* + * Read or write the exact contents of a file, + * along with a buffer, (if applicable) offset, + * and number of bytes to be read. It unified + * the functionality of read(), pread(), write() + * and pwrite(), with retry-on-EINTR and also + * prevents infinite loop on zero-reads. + * + * The pread() and pwrite() functionality are + * provided by yet another portable function, + * prw() - see notes below. + * + * This must only be used on files. It cannot + * be used on sockets or pipes, because 0-byte + * reads are treated like fatal errors. This + * means that EOF is also considered fatal. + */ +static ssize_t rw_file_exact(int fd, uint8_t *mem, size_t len, - off_t off, int rw_type, const char *path, - const char *rw_type_str) + off_t off, int rw_type) { ssize_t rval = 0; size_t rc = 0; - if (fd < 0) - err(EIO, "%s: %s: Bad fd %d", path, rw_type_str, fd); - if (!len) - err(EIO, "%s: %s: Zero length", path, rw_type_str); - if (len > (size_t)SSIZE_MAX) - err(EIO, - "%s: %s: Requested length (%lu) exceeds SSIZE_MAX (%ld)", - path, rw_type_str, (unsigned long)len, - (long)SSIZE_MAX); + if (fd < 0 || !len || len > (size_t)SSIZE_MAX) { + set_err_if_unset(EIO); + return -1; + } while (rc < len) { - if (rw_type == PSCHREIB) - rval = prw(fd, mem + rc, len - rc, - off + rc, rw_type, path); - else if (rw_type == SCHREIB) - rval = write(fd, mem + rc, len - rc); - else if (rw_type == PLESEN) - rval = prw(fd, mem + rc, len - rc, - off + rc, rw_type, path); - else if (rw_type == LESEN) - rval = read(fd, mem + rc, len - rc); - else - err(EIO, "%s: %s: Unsupported rw_type", - path, rw_type_str); - - if (rval >= 0) { - if (rval == 0) - err(EIO, "%s: %s: 0-byte return", - path, rw_type_str); + rval = do_rw(fd, mem + rc, len - rc, off + rc, rw_type); - if ((size_t)rval > (len - rc)) - err(EIO, "%s: %s: Buffer overread trap", - path, rw_type_str); - - rc += (size_t)rval; + if (rval < 0 && errno == EINTR) { continue; + } else if (rval < 0) { + set_err_if_unset(EIO); + return -1; + } + if ((size_t)rval > (len - rc) /* Prevent overflow */ + || rval == 0) { /* Prevent infinite 0-byte loop */ + set_err_if_unset(EIO); + return -1; } - if (errno != EINTR) - err(EIO, "%s: %s", path, rw_type_str); - - errno = 0; + rc += (size_t)rval; } + + return rc; } static ssize_t -prw(int fd, void *mem, size_t count, - off_t offset, int rw_type, const char *path) +do_rw(int fd, uint8_t *mem, + size_t len, off_t off, int rw_type) { - off_t old; + if (rw_type == LESEN || rw_type == PLESEN << 2) + return read(fd, mem, len); + + if (rw_type == SCHREIB || rw_type == PSCHREIB << 2) + return write(fd, mem, len); + + if (rw_type == PLESEN || rw_type == PSCHREIB) + return prw(fd, mem, len, off, rw_type); + + set_err_if_unset(EINVAL); + return -1; +} + +/* + * This implements a portable analog of pwrite() + * and pread() - note that this version is not + * thread-safe (race conditions are possible on + * shared file descriptors). + * + * This limitation is acceptable, since nvmutil is + * single-threaded. Portability is the main goal. + */ +static ssize_t +prw(int fd, void *mem, size_t nrw, + off_t off, int rw_type) +{ + off_t off_orig; ssize_t r; - int restore_errno; - int saved_errno = 0; + int saved_errno; - if ((old = lseek_eintr(fd, (off_t)0, SEEK_CUR)) == (off_t)-1) + if ((off_orig = lseek_eintr(fd, (off_t)0, SEEK_CUR)) == (off_t)-1) return -1; - - if (lseek_eintr(fd, offset, SEEK_SET) == (off_t)-1) + if (lseek_eintr(fd, off, SEEK_SET) == (off_t)-1) return -1; do { - if (rw_type == PLESEN) - r = read(fd, mem, count); - else if (rw_type == PSCHREIB) - r = write(fd, mem, count); - else - err(EIO, "%s: Invalid rw_type", path); + r = do_rw(fd, mem, nrw, off, rw_type << 2); } while (r < 0 && errno == EINTR); - if (r < 0) - saved_errno = errno; - - restore_errno = errno; - - if (lseek_eintr(fd, old, SEEK_SET) == (off_t)-1) { - if (saved_errno) + saved_errno = errno; + if (lseek_eintr(fd, off_orig, SEEK_SET) == (off_t)-1) { + if (r < 0) errno = saved_errno; - else - errno = restore_errno; return -1; } - - if (r < 0) - errno = saved_errno; + errno = saved_errno; return r; } static off_t -lseek_eintr(int fd, off_t offset, int whence) +lseek_eintr(int fd, off_t off, int whence) { off_t old; do { - old = lseek(fd, offset, whence); + old = lseek(fd, off, whence); } while (old == (off_t)-1 && errno == EINTR); return old; @@ -1447,7 +1516,7 @@ err(int nvm_errval, const char *msg, ...) * one that does this. * * Since the errval is for setting errno, -1 - * would be incorrect. Therefore, set_err() + * would be incorrect. Therefore, set_err_if_unset() * avoids overriding errno if the given value * is negative. * @@ -1462,7 +1531,7 @@ err(int nvm_errval, const char *msg, ...) vfprintf(stderr, msg, args); va_end(args); - set_err(nvm_errval); + set_err_if_unset(nvm_errval); fprintf(stderr, ": %s", strerror(errno)); fprintf(stderr, "\n"); @@ -1501,8 +1570,17 @@ getnvmprogname(void) return argv0; } +/* + * Set errno only if it hasn't already been set. + * This prevents overriding real libc errors. + * + * We use errno for regular program state, while + * being careful not to clobber what was set by + * real libc function, or a minority of our stub + * functions such as prw() + */ static void -set_err(int x) +set_err_if_unset(int x) { if (errno) return; @@ -1519,7 +1597,7 @@ usage(uint8_t usage_exit) #ifdef NVMUTIL_PLEDGE if (pledge("stdio", NULL) == -1) - err(ECANCELED, "pledge"); + err(errno, "pledge"); #endif fprintf(stderr, "Modify Intel GbE NVM images e.g. set MAC\n" |