Commit Graph

3703 Commits

Author SHA1 Message Date
Leah Rowe 4a5a3bae45 util/nvmutil: tidy up prw()
Signed-off-by: Leah Rowe <leah@libreboot.org>
2026-03-26 06:59:41 +00:00
Leah Rowe fe959f9fb8 util/nvmutil: extra overflow check in prw
compliant posix systems should never meet this
check, but i put it here.

spec != implementation

Signed-off-by: Leah Rowe <leah@libreboot.org>
2026-03-26 06:59:41 +00:00
Leah Rowe b60c42dcd0 util/nvmutil: extra overflow check in prw
do it at the very end

Signed-off-by: Leah Rowe <leah@libreboot.org>
2026-03-26 06:59:41 +00:00
Leah Rowe 742b39be8c util/nvmutil: handle EAGAIN in prw()
the cat function can be greatly simplified

handle it conditionally, because not all
functions should use it

Signed-off-by: Leah Rowe <leah@libreboot.org>
2026-03-26 06:59:41 +00:00
Leah Rowe 7e8f375d9a util/nvmutil: split up rw_file_exact
move the gbe-specific parts out of it

what remains is a relatively generic
function; a very conservative implementation,
wrapping around libc functions but with
a few additional safety checks.

Signed-off-by: Leah Rowe <leah@libreboot.org>
2026-03-26 06:59:41 +00:00
Leah Rowe e71f977468 util/nvmutil: add negative off check to prw
Signed-off-by: Leah Rowe <leah@libreboot.org>
2026-03-26 06:59:41 +00:00
Leah Rowe fb57cedded util/nvmutil: also do libc check on normal io
Signed-off-by: Leah Rowe <leah@libreboot.org>
2026-03-26 06:59:41 +00:00
Leah Rowe 2a83a8ec43 util/nvmutil: properly reset lseek on error
don't return. set r instead. this will fall through
and return the same way, but with proper reset.

Signed-off-by: Leah Rowe <leah@libreboot.org>
2026-03-26 06:59:41 +00:00
Leah Rowe 935d082a51 util/nvmutil: move libc check to prw()
this still gets done from rw_once, but
it's generic enough that we want it in
our prw() wrapper function.

Signed-off-by: Leah Rowe <leah@libreboot.org>
2026-03-26 06:59:41 +00:00
Leah Rowe 07fa9bbc1f util/nvmutil: remove io_args()
most of it can be done in rw_file_once

truly general checks have been moved to prw(),
so that the function is more general purpose.

Signed-off-by: Leah Rowe <leah@libreboot.org>
2026-03-26 06:59:41 +00:00
Leah Rowe 4bb64c8d37 util/nvmutil: move EINTR handle to prw()
this way, we now have a universal function
that is reusable elsewhere, with the same
redundancy. the rw_once and rw_exact functions
still get this redundancy, through prw

Signed-off-by: Leah Rowe <leah@libreboot.org>
2026-03-26 06:59:41 +00:00
Leah Rowe 223932c5f8 util/nvmutil: simplify i/o
we can just fall through to nrw and decide
what function ta call there - either read/write
immediately and return, or fall back to the
portable positional implementation.

this also means we don't have to call io_args
in every function, since everything now runs
through prw()

Signed-off-by: Leah Rowe <leah@libreboot.org>
2026-03-26 06:59:41 +00:00
Leah Rowe 8071d7eaa8 util/nvmutil: cast rnum pointer check
Signed-off-by: Leah Rowe <leah@libreboot.org>
2026-03-26 06:59:41 +00:00
Leah Rowe 74077f9903 util/nvmutil: allow ushort to be 32-bit
no need to limit it here

rename ux to uint. no number specified.

Signed-off-by: Leah Rowe <leah@libreboot.org>
2026-03-26 06:59:41 +00:00
Leah Rowe 4c0ec27b4e util/nvmutil: fix int assert
it can be higher than 32-bit, it's fine

the current check breaks some newer systems

accordingly, u32 becomes ux, x meaning x bits

Signed-off-by: Leah Rowe <leah@libreboot.org>
2026-03-26 06:59:41 +00:00
Leah Rowe dc6df36fe5 util/nvmutil: more asserts
Signed-off-by: Leah Rowe <leah@libreboot.org>
2026-03-26 06:59:41 +00:00
Leah Rowe 23fee345fd util/nvmutil: nicer typedefs
now that i'm not using stdint, i can use sane
typedef names

Signed-off-by: Leah Rowe <leah@libreboot.org>
2026-03-26 06:59:41 +00:00
Leah Rowe 9cfae27bf4 util/nvmutil: remove stdint feature macro
and remove stdint

i don't need it. i typedef these ints myself
and i assert their size

Signed-off-by: Leah Rowe <leah@libreboot.org>
2026-03-26 06:59:41 +00:00
Leah Rowe 888107764d util/nvmutil: safer offset check (use subtraction)
don't allow overflows

Signed-off-by: Leah Rowe <leah@libreboot.org>
2026-03-26 06:59:41 +00:00
Leah Rowe abc484713a util/nvmutil: check null pointer in io_args
Signed-off-by: Leah Rowe <leah@libreboot.org>
2026-03-26 06:59:41 +00:00
Leah Rowe e1cd978f01 util/nvmutil: check overflow in io_args
Signed-off-by: Leah Rowe <leah@libreboot.org>
2026-03-26 06:59:41 +00:00
Leah Rowe 5f8593b581 util/nvmutil: fix offset validation
i didn't take into account partial writes, in io_args

this fixes it

unfortunately, this means i have to loosen the offset
check a bit, but it's fine

Signed-off-by: Leah Rowe <leah@libreboot.org>
2026-03-26 06:59:41 +00:00
Leah Rowe 6ad09f55e0 util/nvmutil: restrict pointers in io_args
Signed-off-by: Leah Rowe <leah@libreboot.org>
2026-03-26 06:59:41 +00:00
Leah Rowe 8e555f444c util/nvmutil: check gbe file type before write
Signed-off-by: Leah Rowe <leah@libreboot.org>
2026-03-26 06:59:41 +00:00
Leah Rowe 47936f52e9 util/nvmutil: check gbe file size before write
re-check. very unlikely since the program doesn't run
for very long, but we have to check if the file has
changed. this is a basic check of file size.

we could probably check the contents too, but that
would be overkill.

Signed-off-by: Leah Rowe <leah@libreboot.org>
2026-03-26 06:59:41 +00:00
Leah Rowe 551470cf6f util/nvmutil: lock gbe file
Signed-off-by: Leah Rowe <leah@libreboot.org>
2026-03-26 06:59:41 +00:00
Leah Rowe afcdae1350 util/nvmutil: don't allow symlinks
Signed-off-by: Leah Rowe <leah@libreboot.org>
2026-03-26 06:59:41 +00:00
Leah Rowe 98466398f9 nvmutil: fix bound check in last commit
i was fixing the size, but it should be calculated
properly.

Signed-off-by: Leah Rowe <leah@libreboot.org>
2026-03-26 06:59:41 +00:00
Leah Rowe e44b297db5 util/nvmutul: remove unused arg in io_args
Signed-off-by: Leah Rowe <leah@libreboot.org>
2026-03-26 06:59:41 +00:00
Leah Rowe 83f67bf02a util/nvmutil: block bad offset in io_args
Signed-off-by: Leah Rowe <leah@libreboot.org>
2026-03-26 06:59:41 +00:00
Leah Rowe 14ab4c1b25 util/nvmutil: stricter i/o arg checks
Signed-off-by: Leah Rowe <leah@libreboot.org>
2026-03-26 06:59:41 +00:00
Leah Rowe 386f715a29 util/nvmutil: stricter i/o length check
Signed-off-by: Leah Rowe <leah@libreboot.org>
2026-03-26 06:59:41 +00:00
Leah Rowe d8be79432c util/nvmutil: rename len to nrw in i/o
consistent with prw()

i prefer nrw (number of rw operations)

Signed-off-by: Leah Rowe <leah@libreboot.org>
2026-03-26 06:59:41 +00:00
Leah Rowe 5ece694e67 util/nvmutil: tidy up prw()
Signed-off-by: Leah Rowe <leah@libreboot.org>
2026-03-26 06:59:41 +00:00
Leah Rowe 3e08c0724b util/nvmutil: block O_APPEND in prw()
O_APPEND allows writes at EOF, thus breaking
positional read/write

Signed-off-by: Leah Rowe <leah@libreboot.org>
2026-03-26 06:59:41 +00:00
Leah Rowe 7836a2bbc6 util/nvmutil: stricter i/o errors
Signed-off-by: Leah Rowe <leah@libreboot.org>
2026-03-26 06:59:41 +00:00
Leah Rowe 0c9bcaaba8 util/nvmutil: fix entropy issue
the time difference used here could go negative, which
would overflow in the xor op on mix, leading to a biased
entropy pool. we want to ensure that they numbers do
not overflow, because here they are cast to unsigned
which would then produce very large numbers.

Signed-off-by: Leah Rowe <leah@libreboot.org>
2026-03-26 06:59:41 +00:00
Leah Rowe 475c50932e nvmutil: cast integer in printf
Signed-off-by: Leah Rowe <leah@libreboot.org>
2026-03-26 06:59:41 +00:00
Leah Rowe 6f26bd5db7 TODO
Signed-off-by: Leah Rowe <leah@libreboot.org>
2026-03-26 06:59:41 +00:00
Leah Rowe 1abc40997f util/nvmutil: check defines/enum via assert
not at runtime

Signed-off-by: Leah Rowe <leah@libreboot.org>
2026-03-26 06:59:41 +00:00
Leah Rowe 435b67327e util/nvmutil: r_type check in rw_gbe_file_part
i already send the right arg anyway. this is a
preventative bug fix against future maintenance.

Signed-off-by: Leah Rowe <leah@libreboot.org>
2026-03-26 06:59:41 +00:00
Leah Rowe 54536b0454 util/nvmutil: remove pointless check
already checked below, then err()

Signed-off-by: Leah Rowe <leah@libreboot.org>
2026-03-26 06:59:41 +00:00
Leah Rowe f99921d717 util/nvmutil: add missing cast
Signed-off-by: Leah Rowe <leah@libreboot.org>
2026-03-26 06:59:41 +00:00
Leah Rowe ddf13a7e74 util/nvmutil: err in rw_file_exact on zero return
zero never occurs, because rw_file_once never returns zero,
but only rw_file_once determines that. rw_file_exact must
handle every possible error.

right now, if that call returns zero, rw_file_exact would
have an infinite loop.

this doesn't actually happen at the moment, so this is a
preventative bug fix.

Signed-off-by: Leah Rowe <leah@libreboot.org>
2026-03-26 06:59:41 +00:00
Leah Rowe a0ca693d42 util/nvmutil: increment rc at end of rw_file_exact
for fussy static analysers and/or compilers

Signed-off-by: Leah Rowe <leah@libreboot.org>
2026-03-26 06:59:41 +00:00
Leah Rowe 1dbd679c0c util/nvmutil: further tidy up prw()
Signed-off-by: Leah Rowe <leah@libreboot.org>
2026-03-26 06:59:41 +00:00
Leah Rowe e239a3107f util/nvmutil: clean up i/o functions
properly verify the value of the arguments, with
asserts.

add simpler runtime checks in-function, on prw,
rw_file_once and rw_file_exact.

variable names in english now, and the code is
cleaner, while being functionally equivalent.

Signed-off-by: Leah Rowe <leah@libreboot.org>
2026-03-26 06:59:41 +00:00
Leah Rowe 347e39bab7 util/nvmutil: further tidy up rw_file_once
Signed-off-by: Leah Rowe <leah@libreboot.org>
2026-03-26 06:59:41 +00:00
Leah Rowe b4154dd29b util/nvmutil: minor cleanup: rw_file_once
Signed-off-by: Leah Rowe <leah@libreboot.org>
2026-03-26 06:59:41 +00:00
Leah Rowe a85f2898e2 util/nvmutil: remove dead code
useless check. will never be true.

Signed-off-by: Leah Rowe <leah@libreboot.org>
2026-03-26 06:59:41 +00:00