=================================================================== RCS file: /cvs/openbsd/fw_update/fw_install.sh,v retrieving revision 1.2 retrieving revision 1.118 diff -u -r1.2 -r1.118 --- openbsd/fw_update/fw_install.sh 2021/10/05 01:39:05 1.2 +++ openbsd/fw_update/fw_install.sh 2021/12/24 00:46:02 1.118 @@ -1,119 +1,192 @@ #!/bin/ksh -set -e +# $OpenBSD: fw_install.sh,v 1.118 2021/12/24 00:46:02 afresh1 Exp $ +# +# Copyright (c) 2021 Andrew Hewus Fresh +# +# Permission to use, copy, modify, and distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES +# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF +# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR +# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES +# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN +# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF +# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. -scan_dmesg() { - # no bsort for now - sed -n "$1" /var/run/dmesg.boot -} +set -o errexit -o pipefail -o nounset -o noclobber -o noglob +set +o monitor +export PATH=/usr/bin:/bin:/usr/sbin:/sbin -installed_firmware() { - for fw in ${PKGDIR}/$1-firmware*; do - [ -e "$fw" ] || continue - echo ${fw##*/} - done +CFILE=SHA256.sig +DESTDIR=${DESTDIR:-} +FWPATTERNS="${DESTDIR}/usr/share/misc/firmware_patterns" + +VNAME=${VNAME:-$(sysctl -n kern.osrelease)} +VERSION=${VERSION:-"${VNAME%.*}${VNAME#*.}"} + +HTTP_FWDIR="$VNAME" +VTYPE=$( sed -n "/^OpenBSD $VNAME\([^ ]*\).*$/s//\1/p" \ + /var/run/dmesg.boot | sed '$!d' ) +[[ $VTYPE == -!(stable) ]] && HTTP_FWDIR=snapshots + +FWURL=http://firmware.openbsd.org/firmware/${HTTP_FWDIR} +FWPUB_KEY=${DESTDIR}/etc/signify/openbsd-${VERSION}-fw.pub + +VERBOSE=false +DELETE=false +DOWNLOAD=true +INSTALL=true +LOCALSRC= + +tmpdir() { + local _i=1 _dir + + # If we're not in the installer, + # we have mktemp and a more hostile environment. + if [ -x /usr/bin/mktemp ]; then + _dir=$( mktemp -d "${1}-XXXXXXXXX" ) + else + until _dir="${1}.$_i.$RANDOM" && mkdir -- "$_dir" 2>/dev/null; do + ((++_i < 10000)) || return 1 + done + fi + + echo "$_dir" } -set -A _KERNV -- $( scan_dmesg '/^OpenBSD \([1-9][0-9]*\.[0-9]\)\([^ ]*\) .*/ { s//\1 \2/p; q; }' ) -VNAME=${_KERNV[0]} -OSDIR=$VNAME -if ((${#_KERNV[*]} > 1)) && [ "$_KERNV[1]" = "-current" -o "$_KERNV[1]" = "-beta" ]; then - OSDIR=snapshots -fi +fetch() { + local _src="${FWURL}/${1##*/}" _dst=$1 _user=_file _pid _exit _error='' -FWURL=http://firmware.openbsd.org/firmware/${OSDIR} -PKGDIR=${DESTDIR}/var/db/pkg -PATTERNS="file:${0%/*}/firmware_patterns" + # If we're not in the installer, + # we have su(1) and doas(1) is unlikely to be configured. + set -o monitor # make sure ftp gets its own process group + ( + flags=-VM + "$VERBOSE" && flags=-vm + if [ -x /usr/bin/su ]; then + exec /usr/bin/su -s /bin/ksh "$_user" -c \ + "/usr/bin/ftp -D 'Get/Verify' $flags -o- '$_src'" > "$_dst" + else + exec /usr/bin/doas -u "$_user" \ + /usr/bin/ftp -D 'Get/Verify' $flags -o- "$_src" > "$_dst" + fi + ) & _pid=$! + set +o monitor -drivers=$( - last='' - ftp -D "Detecting" -Vmo- $PATTERNS | - while read d m; do - [ "$last" = "$d" ] && continue - [ "$m" ] || m="^$d[0-9][0-9]* at " - grep -q "$m" /var/run/dmesg.boot || continue - echo $d - last=$d + trap "kill -TERM '-$_pid' 2>/dev/null; exit 1" EXIT INT QUIT ABRT TERM + + SECONDS=0 + _last=0 + while kill -0 -"$_pid" 2>/dev/null; do + if [[ $SECONDS -gt 12 ]]; then + set -- $( ls -ln "$_dst" 2>/dev/null ) + if [[ $_last -ne $5 ]]; then + _last=$5 + SECONDS=0 + sleep 1 + else + kill -INT -"$_pid" + _error=" (timed out)" + fi + else + sleep 1 + fi done -) -if [ -z "$drivers" ]; then - echo "No devices found which need firmware files to be downloaded." >&2 - exit 0 -fi + set +o errexit + wait "$_pid" + _exit=$? + set -o errexit -tmpdir=${DESTDIR}/tmp/fw_update -[ -e "$tmpdir" ] && rm -rf "$tmpdir" -mkdir -p "$tmpdir" -cd "$tmpdir" + trap "" EXIT INT QUIT ABRT TERM -# TODO: Drop privs during fetch and verify -ftp -D Get -Vm "$FWURL/SHA256.sig" + if [ "$_exit" -ne 0 ]; then + rm -f "$_dst" + echo "Cannot fetch $_src$_error" >&2 + return 1 + fi +} -# Probably should bundle the firmware sigfile on the installer, -# although we can just get it from the recently installed system. -if [ "$DESTDIR" ]; then - sigfile=$( sed -n '/^untrusted comment: verify with \(.*\)$/ { s//\1/p; q; }' SHA256.sig ) - if [ ! -e "/etc/signify/$sigfile" ] \ - && [ -e "${DESTDIR}/etc/signify/$sigfile" ]; then - cp -a "${DESTDIR}/etc/signify/$sigfile" "/etc/signify/$sigfile" +verify() { + # On the installer we don't get sha256 -C, so fake it. + if ! fgrep -qx "SHA256 (${1##*/}) = $( /bin/sha256 -qb "$1" )" "$CFILE"; then + echo "Checksum test for ${1##*/} failed." >&2 + return 1 fi -fi +} -signify -Ve -x SHA256.sig -m - < SHA256.sig > SHA256 +devices_needing_firmware() { + local _d _m _line _dmesgtail _last='' _nl=$( echo ) -for d in $drivers; do - firmware=$( sed -n "s/.*(\($d-firmware-.*\.tgz\)).*/\1/p" SHA256 ) - installed=$( installed_firmware $d ) + # When we're not in the installer, the dmesg.boot can + # contain multiple boots, so only look in the last one + _dmesgtail="$( echo ; sed -n 'H;/^OpenBSD/h;${g;p;}' /var/run/dmesg.boot | + grep -e "^[a-z][a-z]*[0-9]" -e " not configured " )" - for i in $installed; do - if [ "$firmware" = "$i.tgz" ]; then - echo "Firmware for $d already installed ($installed)" - continue 2 + grep -v '^[[:space:]]*#' "$FWPATTERNS" | + while read -r _d _m; do + [ "$_d" = "$_last" ] && continue + [ "$_m" ] || _m="${_nl}${_d}[0-9] at " + [ "$_m" = "${_m#^}" ] || _m="${_nl}${_m#^}" + + if [[ $_dmesgtail = *$_m* ]]; then + echo "$_d" + _last="$_d" fi - done + done +} - mkdir $d +firmware_filename() { + local _f + _f="$( sed -n "s/.*(\($1-firmware-.*\.tgz\)).*/\1/p" "$CFILE" | sed '$!d' )" + ! [ "$_f" ] && echo "Unable to find firmware for $1" >&2 && return 1 + echo "$_f" +} - # TODO: Drop privs during fetch and verify - ftp -D "Get/Verify" -Vmo- "$FWURL/$firmware" | sha256 -bph "$d/h" > "$firmware" - fgrep -qx "SHA256 ($firmware) = $(<$d/h)" SHA256 +firmware_devicename() { + local _d="${1##*/}" + _d="${_d%-firmware-*}" + echo "$_d" +} - # TODO: Check hash for files before deleting - if [ "$installed" ] && [ -e "${PKGDIR}/$installed/+CONTENTS" ]; then - echo "Uninstalling $installed" - cwd=${PKGDIR}/$installed +installed_firmware() { + local _pre="$1" _match="$2" _post="$3" _firmware + set -A _firmware -- $( + set +o noglob + grep -Fxl '@option firmware' \ + "${DESTDIR}/var/db/pkg/"$_pre"$_match"$_post"/+CONTENTS" \ + 2>/dev/null || true + set -o noglob + ) - remove="${cwd}/+CONTENTS ${cwd}" + [ "${_firmware[*]:-}" ] || return 0 + for fw in "${_firmware[@]}"; do + fw="${fw%/+CONTENTS}" + echo "${fw##*/}" + done +} - while read c g; do - case $c in - @cwd) cwd=$g - ;; - @*) continue - ;; - *) remove="$cwd/$c $remove" - ;; - esac - done < "${PKGDIR}/$installed/+CONTENTS" +add_firmware () { + local _f="${1##*/}" _pkgname + local _tmpdir="$( tmpdir "${DESTDIR}/var/db/pkg/.firmware" )" + local flags=-VM + "$VERBOSE" && flags=-vm + ftp -D "Install" "$flags" -o- "file:${1}" | + tar -s ",^\+,${_tmpdir}/+," \ + -s ",^firmware,${DESTDIR}/etc/firmware," \ + -C / -zxphf - "+*" "firmware/*" - for r in $remove ; do - if [ -d "$r" ]; then - # Try hard not to actually remove recursively - # without rmdir on the install media. - [ "$r/*" = $( echo "$r"/* ) ] && rm -rf "$r" - else - rm -f "$r" - fi - done + _pkgname="$( sed -n '/^@name /{s///p;q;}' "${_tmpdir}/+CONTENTS" )" + if [ ! "$_pkgname" ]; then + echo "Failed to extract name from $1, partial install" 2>&1 + rm -rf "$_tmpdir" + return 1 fi - # TODO: Add some details about the install to +CONTENTS like pkg_add - # TODO: Or, maybe we save the firmware someplace and make pkg_add reinstall - echo "Installing $firmware" - tar -zxphf "$firmware" -C /etc "firmware/*" - mkdir -p ${PKGDIR}/${firmware%.tgz}/ - tar -zxphf "$firmware" -C "${PKGDIR}/${firmware%.tgz}" "+*" - ed -s "${PKGDIR}/${firmware%.tgz}/+CONTENTS" <&2 + return 2 + fi + + set -A _remove -- "${_cwd}/+CONTENTS" "${_cwd}" + + while read -r c g; do + case $c in + @cwd) _cwd="${DESTDIR}$g" + ;; + @*) continue + ;; + *) set -A _remove -- "$_cwd/$c" "${_remove[@]}" + ;; + esac + done < "${_pkgdir}/${_pkg}/+CONTENTS" + + # We specifically rm -f here because not removing files/dirs + # is probably not worth failing over. + for _r in "${_remove[@]}" ; do + if [ -d "$_r" ]; then + # Try hard not to actually remove recursively + # without rmdir on the install media. + set +o noglob + [ "$_r/*" = "$( echo "$_r"/* )" ] && rm -rf "$_r" + set -o noglob + else + rm -f "$_r" + fi + done +} + +usage() { + echo "usage: ${0##*/} [-d | -D | -L] [-av] [driver | file ...]" + exit 2 +} + +ALL=false +OPT_D= +OPT_L= +while getopts :adDLv name +do + case "$name" in + a) ALL=true ;; + d) DELETE=true ;; + D) OPT_D=true ;; + L) OPT_L=true ;; + v) VERBOSE=true ;; + ?) echo "${0##*/}: unknown option -- -$OPTARG"; usage 2 ;; + esac done +shift $((OPTIND - 1)) +[ "$OPT_D" ] && [ "$OPT_L" ] && usage 1 + +if [ "$OPT_D" ]; then + # "Download only" means local dir and don't install + INSTALL=false + LOCALSRC=. +elif [ "$OPT_L" ]; then + # "Local" means don't download, install from local dir + DOWNLOAD=false + LOCALSRC=. +else + LOCALSRC="$( tmpdir "${DESTDIR}/tmp/${0##*/}" )" +fi + +CFILE="$LOCALSRC/$CFILE" + +if [ -x /usr/bin/id ] && [ "$(/usr/bin/id -u)" != 0 ]; then + echo "need root privileges" >&2 + exit 1 +fi + +set -A devices -- "$@" + +if "$DELETE"; then + [ "$OPT_D" ] || [ "$OPT_L" ] && usage 22 + + set -A installed + if [ "${devices[*]:-}" ]; then + "$ALL" && usage 22 + + set -A installed -- $( + for d in "${devices[@]}"; do + f="${d##*/}" # only care about the name + f="${f%.tgz}" # allow specifying the package name + [ "$( firmware_devicename "$f" )" = "$f" ] && f="$f-firmware" + + set -A i -- $( installed_firmware '' "$f-" '*' ) + + if [ "${i[*]:-}" ]; then + echo "${i[@]}" + else + echo "No firmware found for '$d'" >&2 + fi + done + ) + elif "$ALL"; then + set -A installed -- $( installed_firmware '*' '-firmware-' '*' ) + fi + + deleted='' + if [ "${installed:-}" ]; then + for fw in "${installed[@]}"; do + delete_firmware "$fw" || continue + deleted="$deleted,$( firmware_devicename "$fw" )" + done + fi + + deleted="${deleted:+${deleted#,}}" + echo "${0:##*/}: deleted ${deleted:-none}"; + + exit +fi + +if [ "${devices[*]:-}" ]; then + "$ALL" && usage 22 +else + "$VERBOSE" && echo -n "Detecting firmware ..." + set -A devices -- $( devices_needing_firmware ) + "$VERBOSE" && + { [ "${devices[*]:-}" ] && echo " found." || echo " done." ; } +fi + +[ "${devices[*]:-}" ] || exit + +if "$DOWNLOAD"; then + set +o noclobber # we want to get the latest CFILE + fetch "$CFILE" + set -o noclobber + ! signify -qVep "$FWPUB_KEY" -x "$CFILE" -m "$CFILE" && + echo "Signature check of SHA256.sig failed" >&2 && exit 1 +fi + +added='' +updated='' +kept='' +for f in "${devices[@]}"; do + d="$( firmware_devicename "$f" )" + + if [ "$f" = "$d" ]; then + f=$( firmware_filename "$d" || true ) + [ "$f" ] || continue + f="$LOCALSRC/$f" + elif ! "$INSTALL" && ! grep -Fq "($f)" "$CFILE" ; then + echo "Cannot download local file $f" >&2 + exit 2 + fi + + set -A installed -- $( installed_firmware '' "$d-firmware-" '*' ) + + if "$INSTALL" && [ "${installed[*]:-}" ]; then + for i in "${installed[@]}"; do + if [ "${f##*/}" = "$i.tgz" ]; then + "$VERBOSE" && echo "$i already installed" + kept="$kept,$d" + continue 2 + fi + done + fi + + if [ -e "$f" ]; then + if "$DOWNLOAD"; then + "$VERBOSE" && echo "Verify existing ${f##*/}" + verify "$f" || continue + "$INSTALL" || kept="$kept,$d" + # else assume it was verified when downloaded + fi + elif "$DOWNLOAD"; then + fetch "$f" || continue + verify "$f" || continue + "$INSTALL" || added="$added,$d" + elif "$INSTALL"; then + echo "Cannot install ${f##*/}, not found" >&2 + continue + fi + + "$INSTALL" || continue + + removed=false + if [ "${installed[*]:-}" ]; then + for i in "${installed[@]}"; do + delete_firmware "$i" + removed=true + done + fi + + add_firmware "$f" + + if "$removed"; then + updated="$updated,$d" + else + added="$added,$d" + fi +done + +added="${added:#,}" +updated="${updated:#,}" +kept="${kept:#,}" +if "$INSTALL"; then + echo "${0##*/}: added ${added:-none}; updated ${updated:-none}; kept ${kept:-none}" +else + echo "${0##*/}: downloaded ${added:-none}; kept ${kept:-none}" +fi