coja/lbmk
1
0
Fork 0
mirror of https://codeberg.org/libreboot/lbmk.git synced 2026-07-11 05:52:36 +02:00
Code Issues Packages Projects Releases Wiki Activity
3,870 Commits 22 Branches 45 Tags
182ea657741ebbf9fd148436374f909f4ca23669
Commit Graph

3870 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Leah Rowe 182ea65774 util/nvmutil: fix comment 
Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:42 +00:00
Leah Rowe 3871b60124 util/nvmutil: default to clang on make-hell 
Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:42 +00:00
Leah Rowe 5d7e516e33 util/nvmutil: tidy up memcmp 
Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:42 +00:00
Leah Rowe 2fe71dfb90 nvmutil: add suffixes to makefile 
Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:42 +00:00
Leah Rowe 2457944d75 nvmutil: tidy up the makefile 
Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:42 +00:00
Leah Rowe 92580f0659 util/nvmutil: portable default make rules 
older compilers might not have -std for example.

the code is portable, but old compilers can't
compile with just "make", you have to add lots
of flags

i will now use "make strict" and "make hell"
in testing, but otherwise make without flags
are fine.

move the current strictness to command:

make strict

added an extra command:

make hell

hell uses -Weverything, and is useful with
clang's strict testing, on which i only got
a very small number of errors (it's way less
than a lot of programs would get with this
flag, because -Weverything is REALLY STRICT):

ja, mich nvmutil$ make hell CC=clang
clang -I.   -Wall -Wextra -pedantic -std=c90 -Os -Werror -Weverything nvmutil.c -o nvmutil
In file included from nvmutil.c:35:
./nvmutil.h:225:16: error: padding struct 'struct commands' with 1 byte to align 'rw_size' [-Werror,-Wpadded]
  225 |         unsigned long rw_size; /* within the 4KB GbE part */
      |                       ^
./nvmutil.h:217:8: error: padding size of 'struct commands' with 4 bytes to alignment boundary [-Werror,-Wpadded]
  217 | struct commands {
      |        ^
./nvmutil.h:235:8: error: padding size of 'struct xfile' with 4 bytes to alignment boundary [-Werror,-Wpadded]
  235 | struct xfile {
      |        ^
./nvmutil.h:288:16: error: padding struct 'struct xstate' with 4 bytes to align 'xsize' [-Werror,-Wpadded]
  288 |         unsigned long xsize;
      |                       ^
nvmutil.c:617:43: error: implicit conversion changes signedness: 'off_t' (aka 'long') to 'unsigned long' [-Werror,-Wsign-conversion]
  617 |         _r = rw_file_exact(f->gbe_fd, f->buf, f->gbe_file_size,
      |              ~~~~~~~~~~~~~                    ~~~^~~~~~~~~~~~~
nvmutil.c:626:43: error: implicit conversion changes signedness: 'off_t' (aka 'long') to 'unsigned long' [-Werror,-Wsign-conversion]
  626 |         _r = rw_file_exact(f->tmp_fd, f->buf, f->gbe_file_size,
      |              ~~~~~~~~~~~~~                    ~~~^~~~~~~~~~~~~
nvmutil.c:654:46: error: implicit conversion changes signedness: 'off_t' (aka 'long') to 'unsigned long' [-Werror,-Wsign-conversion]
  654 |         _r = rw_file_exact(f->tmp_fd, f->bufcmp, f->gbe_file_size,
      |              ~~~~~~~~~~~~~                       ~~~^~~~~~~~~~~~~
nvmutil.c:661:39: error: implicit conversion changes signedness: 'off_t' (aka 'long') to 'unsigned long' [-Werror,-Wsign-conversion]
  661 |         if (x_i_memcmp(f->buf, f->bufcmp, f->gbe_file_size) != 0)
      |             ~~~~~~~~~~                    ~~~^~~~~~~~~~~~~
nvmutil.c:702:23: error: implicit conversion loses integer precision: 'int' to 'unsigned char' [-Werror,-Wimplicit-int-conversion]
  702 |                 f->part_valid[_p] = good_checksum(_p);
      |                                   ~ ^~~~~~~~~~~~~~~~~
nvmutil.c:1045:21: error: implicit conversion loses integer precision: 'int' to 'unsigned char' [-Werror,-Wimplicit-int-conversion]
 1045 |         f->part_valid[0] = good_checksum(0);
      |                          ~ ^~~~~~~~~~~~~~~~
nvmutil.c:1046:21: error: implicit conversion loses integer precision: 'int' to 'unsigned char' [-Werror,-Wimplicit-int-conversion]
 1046 |         f->part_valid[1] = good_checksum(1);
      |                          ~ ^~~~~~~~~~~~~~~~
nvmutil.c:1170:45: error: implicit conversion changes signedness: 'off_t' (aka 'long') to 'unsigned long' [-Werror,-Wsign-conversion]
 1170 |                     (unsigned long)(p * (f->gbe_file_size >> 1)));
      |                                       ~  ~~~~~~~~~~~~~~~~~^~~~
nvmutil.c:1269:37: error: implicit conversion loses integer precision: 'int' to 'unsigned short' [-Werror,-Wimplicit-int-conversion]
 1269 |         return (unsigned short)f->buf[pos] |
      |         ~~~~~~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~^
 1270 |             ((unsigned short)f->buf[pos + 1] << 8);
      |             ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
nvmutil.c:1610:9: error: implicit conversion changes signedness: 'off_t' (aka 'long') to 'unsigned long' [-Werror,-Wsign-conversion]
 1609 |         r = rw_file_exact(f->tmp_fd, f->bufcmp,
      |             ~~~~~~~~~~~~~
 1610 |             f->gbe_file_size, 0, IO_PREAD,
      |             ~~~^~~~~~~~~~~~~
nvmutil.c:1618:9: error: implicit conversion changes signedness: 'off_t' (aka 'long') to 'unsigned long' [-Werror,-Wsign-conversion]
 1617 |         r = rw_file_exact(dest_fd, f->bufcmp,
      |             ~~~~~~~~~~~~~
 1618 |             f->gbe_file_size, 0, IO_PWRITE,
      |             ~~~^~~~~~~~~~~~~
nvmutil.c:1609:6: error: implicit conversion loses integer precision: 'long' to 'int' [-Werror,-Wshorten-64-to-32]
 1609 |         r = rw_file_exact(f->tmp_fd, f->bufcmp,
      |           ~ ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 1610 |             f->gbe_file_size, 0, IO_PREAD,
      |             ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 1611 |             NO_LOOP_EAGAIN, LOOP_EINTR,
      |             ~~~~~~~~~~~~~~~~~~~~~~~~~~~
 1612 |             MAX_ZERO_RW_RETRY, OFF_ERR);
      |             ~~~~~~~~~~~~~~~~~~~~~~~~~~~
nvmutil.c:1617:6: error: implicit conversion loses integer precision: 'long' to 'int' [-Werror,-Wshorten-64-to-32]
 1617 |         r = rw_file_exact(dest_fd, f->bufcmp,
      |           ~ ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 1618 |             f->gbe_file_size, 0, IO_PWRITE,
      |             ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 1619 |             NO_LOOP_EAGAIN, LOOP_EINTR,
      |             ~~~~~~~~~~~~~~~~~~~~~~~~~~~
 1620 |             MAX_ZERO_RW_RETRY, OFF_ERR);
      |             ~~~~~~~~~~~~~~~~~~~~~~~~~~~
nvmutil.c:1936:45: error: implicit conversion changes signedness: 'long' to 'unsigned long' [-Werror,-Wsign-conversion]
 1936 |                 if (rv >= 0 && (unsigned long)rv > (nrw - rc))
      |                                                         ~ ^~
nvmutil.c:2193:27: error: signed shift result (0x8000000000000000) sets the sign bit of the shift expression's type ('long') and becomes negative [-Werror,-Wshift-sign-overflow]
 2193 |         if (nrw > (unsigned long)X_LONG_MAX)
      |                                  ^~~~~~~~~~
./nvmutil.h:147:38: note: expanded from macro 'X_LONG_MAX'
  147 | #define X_LONG_MAX ((long)(~((long)1 << (sizeof(long)*CHAR_BIT-1))))
      |                              ~~~~~~~ ^  ~~~~~~~~~~~~~~~~~~~~~~~~~
fatal error: too many errors emitted, stopping now [-ferror-limit=]
20 errors generated.
make: *** [Makefile:42: hell] Fehler 1

in a future commit, i intend to fix all of these issues,
so that the code reliably compiles in hell-mode.

Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:42 +00:00
Leah Rowe ac0451c0b8 util/nvmutil: move asserts to header 
Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:42 +00:00
Leah Rowe 611217e57e nvmutil: extremely defensive CHAR_BIT test 
this program needs bits to be 8

some obscure systems set it to something else

Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:42 +00:00
Leah Rowe 38022c5d47 util/nvmutil: add defensive buffer check 
Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:42 +00:00
Leah Rowe 400369b361 util/nvmutil: remove stale comment 
and add another

Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:42 +00:00
Leah Rowe b6d176189e util/nvmutil: fix randomness in mkstemp 
i need to re-initialise r each time.

Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:42 +00:00
Leah Rowe 4688dee7cb util/nvmutil: split up copy_gbe 
Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:42 +00:00
Leah Rowe 60a6d3861c util/nvmuti: make fsync_dir() generic 
yes, this begins the next phase of nvmutil:

remove global status in functions that should be
generic, and make functions that are not generic,
generic. make everything as re-useable in a library
as possible.

most of the program is error control, as it should
be, but much of it is mixed in with functions
that really should just be split up for libraries.

so that is what i'm now beginning.

Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:42 +00:00
Leah Rowe c1c49c3945 prototype for new_state() in nvmutil 
Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:42 +00:00
Leah Rowe 50695c9fbd util/nvmutil: split up nvmutil.c 
i still use a global variable, but now only
one, which is a structure containing the
state of the entire program

now i can easily start modifying it to make
functions generic, and then i can start
making parts of it into easy libraries

Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:42 +00:00
Leah Rowe b1a51d7e5c cleanup 
Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:42 +00:00
Leah Rowe 2703c9c938 util/nvmutil: start removing global state 
for now still actually global, but i'm gradually
putting variables into a single global stucture
which will then allow me to make everything
local, which would then allow me to start
splitting up the program and modularising it.

Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:42 +00:00
Leah Rowe 292f504524 nvmutil: stronger entropy_jitter() 
run it for a bit longer

Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:42 +00:00
Leah Rowe 464fb5c0d8 util/nvmutil: don't use strcpy 
Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:42 +00:00
Leah Rowe cf8cb4bdcc util/nvmutil: check fd path in try_fdpath 
Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:42 +00:00
Leah Rowe ab8929808f util/nvmutil: add bound check to x_try_fdpath 
Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:42 +00:00
Leah Rowe 8911d2c1dd another comment 
it's a pretty insane hack. i should probably
just use normal fchmod

Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:42 +00:00
Leah Rowe c6ae1d5ea2 comment 
also improved the macro, making it stricter

Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:42 +00:00
Leah Rowe 6e6ab09cb0 cleanup (fix potential overflow in mkstemp) 
Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:42 +00:00
Leah Rowe 47a654a870 fsync_dir: abort if path length is empty 
Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:42 +00:00
Leah Rowe d0a125c16d nvmutil: prevent theoretical overflow on time() 
Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:42 +00:00
Leah Rowe 28820d169c also O_NOFOLLOW 
Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:42 +00:00
Leah Rowe 1207b1bb72 util/nvmutil: dir fsync with O_DIRECTORY 
guards against replacement attacks, on systems
that support this flag

Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:42 +00:00
Leah Rowe ddb0bc314d util/nvmutil: fix mkstemp randomness 
i made the string longer, but forgot
to adjust it. the new random function
is also better

Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:42 +00:00
Leah Rowe b951ef2433 cast 
Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:42 +00:00
Leah Rowe 251ba82ccb util/nvmutil: more reliable fallback crypto 
we assume the fallback will be rare, so now we
make the mix static and keep xoring it, on the
theory that the number of failures on urandom
will be random, and tthat the fallback may only
apply once or twice in thousands of calls.

the time jitter is adjusted; rather than judge
the difference between two points close to each
other in time, we judge tthe randomness in
difference of time elapsed. this mitigates fast
CPUs being very fast and introducing rounding
errors, and also improves performonce on much
slower CPUs

Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:42 +00:00
Leah Rowe a575a47733 util/nvmutil: use real rename() syscall 
i was being cute earlier, but the rewrite
defeats the purpose of atomic file handling
in nvmutil, by not actually renaming! it was
more like, doing an actual copy, which meant
that corruption is likely during power loss

i've commented the code because i may
use it in a library in the future.

Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:42 +00:00
Leah Rowe 8e2921f1ce nvmutil: harden against hardlink attacks 
Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:42 +00:00
Leah Rowe 4871f4fda7 redundancy 
Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:42 +00:00
Leah Rowe 0237c9c9c6 util/nvmutil: loop EINTR on fsync 
this improves reliability, making it more
likely that data actually gets synced,
since fsync can return -1 with EINTR,
indicating that a re-try should be
attempted.

Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:41 +00:00
Leah Rowe 5ce5ac2994 pointer safety 
Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:41 +00:00
Leah Rowe 7b62a1653b don't use PATH_MAX 
unreliable

Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:41 +00:00
Leah Rowe 1883325cd0 macro safety 
Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:41 +00:00
Leah Rowe 2b3966feba util/nvmutil: portable S_IFMT 
Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:41 +00:00
Leah Rowe 7650ab051f util/nvmutil: remove integer typedefs 
better to just use standard names

Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:41 +00:00
Leah Rowe 445e96aefc util/nvmutil: remove global statics 
Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:41 +00:00
Leah Rowe 28a499e556 util/nvmutil: fix unveil usage 
arandom probably isn't available on super old obsd right??????

rather, unveil isn't. on systems that have arandom

yet we should not unveil something that may not
exist on modern systems

just don't unveil arandom, and don't check arandom
if unveil is enabled

Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:41 +00:00
Leah Rowe 96dde65d16 util/nvmutil: proper /dev/fd search in fchmod 
some systems may not even have it

works with /dev/fd (bsd/mac etc)

works with linux (/proc/self/fd)

and falls back on super old systems
that have neither

Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:41 +00:00
Leah Rowe 120241f1cf util/nvmutil: tidy up makefile options 
Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:41 +00:00
Leah Rowe c46a634288 nope. put -Werror in the makefile 
not compiling without it is a bug

don't let the default exclude it

Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:41 +00:00
Leah Rowe 71ce22a938 nvmutil makefile: define WERROR but blank it 
settting it to -Werror is wrong, should set
it not -Werror.

however, put the WERROR variable in the make
command. that way, i could test with

make WERROR=-Werror

Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:41 +00:00
Leah Rowe af40114be7 util/nvmutil: portable fchmod 
and with that, now the code compiles on gcc
with -std=c90 -pedantic

with -Werror and -Wall -Wextra

Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:41 +00:00
Leah Rowe a0fd201b31 Revert "util/nvmutil: don't use fsync()" 
This reverts commit bdb43afac6edef21a15f99b8c3beac01be8b86f7.
 2026-03-26 06:59:41 +00:00
Leah Rowe e6b53e8aed util/nvmutil: longer string in mkstemp 
have A-Z too, for more randomness

Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:41 +00:00
Leah Rowe ad5a4771bf util/nvmutil: don't use mktemp 
Signed-off-by: Leah Rowe <leah@libreboot.org>
 2026-03-26 06:59:41 +00:00