1 /*-
2 * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
3 *
4 * Copyright (c) 2011 Sandvine Incorporated. All rights reserved.
5 * Copyright (c) 2002-2011 Andre Albsmeier <[email protected]>
6 * All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 * 1. Redistributions of source code must retain the above copyright
12 * notice, this list of conditions and the following disclaimer,
13 * without modification, immediately at the beginning of the file.
14 * 2. Redistributions in binary form must reproduce the above copyright
15 * notice, this list of conditions and the following disclaimer in the
16 * documentation and/or other materials provided with the distribution.
17 *
18 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
19 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
20 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
21 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
22 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
23 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
24 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
25 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
26 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
27 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
28 */
29
30 /*
31 * This software is derived from Andre Albsmeier's fwprog.c which contained
32 * the following note:
33 *
34 * Many thanks goes to Marc Frajola <[email protected]> from
35 * TeraSolutions for the initial idea and his programme for upgrading
36 * the firmware of I*M DDYS drives.
37 */
38
39 /*
40 * BEWARE:
41 *
42 * The fact that you see your favorite vendor listed below does not
43 * imply that your equipment won't break when you use this software
44 * with it. It only means that the firmware of at least one device type
45 * of each vendor listed has been programmed successfully using this code.
46 *
47 * The -s option simulates a download but does nothing apart from that.
48 * It can be used to check what chunk sizes would have been used with the
49 * specified device.
50 */
51
52 #include <sys/cdefs.h>
53 __FBSDID("$FreeBSD$");
54
55 #include <sys/types.h>
56 #include <sys/stat.h>
57
58 #include <err.h>
59 #include <fcntl.h>
60 #include <stdbool.h>
61 #include <stdio.h>
62 #include <stdlib.h>
63 #include <string.h>
64 #include <unistd.h>
65
66 #include <cam/cam.h>
67 #include <cam/scsi/scsi_all.h>
68 #include <cam/scsi/scsi_pass.h>
69 #include <cam/scsi/scsi_message.h>
70 #include <camlib.h>
71
72 #include "progress.h"
73
74 #include "camcontrol.h"
75
76 #define WB_TIMEOUT 50000 /* 50 seconds */
77
78 typedef enum {
79 VENDOR_HGST,
80 VENDOR_HITACHI,
81 VENDOR_HP,
82 VENDOR_IBM,
83 VENDOR_PLEXTOR,
84 VENDOR_QUALSTAR,
85 VENDOR_QUANTUM,
86 VENDOR_SAMSUNG,
87 VENDOR_SEAGATE,
88 VENDOR_SMART,
89 VENDOR_ATA,
90 VENDOR_UNKNOWN
91 } fw_vendor_t;
92
93 /*
94 * FW_TUR_READY: The drive must return good status for a test unit ready.
95 *
96 * FW_TUR_NOT_READY: The drive must return not ready status for a test unit
97 * ready. You may want this in a removable media drive.
98 *
99 * FW_TUR_NA: It doesn't matter whether the drive is ready or not.
100 * This may be the case for a removable media drive.
101 */
102 typedef enum {
103 FW_TUR_NONE,
104 FW_TUR_READY,
105 FW_TUR_NOT_READY,
106 FW_TUR_NA
107 } fw_tur_status;
108
109 /*
110 * FW_TIMEOUT_DEFAULT: Attempt to probe for a WRITE BUFFER timeout
111 * value from the drive. If we get an answer,
112 * use the Recommended timeout. Otherwise,
113 * use the default value from the table.
114 *
115 * FW_TIMEOUT_DEV_REPORTED: The timeout value was probed directly from
116 * the device.
117 *
118 * FW_TIMEOUT_NO_PROBE: Do not ask the device for a WRITE BUFFER
119 * timeout value. Use the device-specific
120 * value.
121 *
122 * FW_TIMEOUT_USER_SPEC: The user specified a timeout on the command
123 * line with the -t option. This overrides any
124 * probe or default timeout.
125 */
126 typedef enum {
127 FW_TIMEOUT_DEFAULT,
128 FW_TIMEOUT_DEV_REPORTED,
129 FW_TIMEOUT_NO_PROBE,
130 FW_TIMEOUT_USER_SPEC
131 } fw_timeout_type;
132
133 /*
134 * type: Enumeration for the particular vendor.
135 *
136 * pattern: Pattern to match for the Vendor ID from the SCSI
137 * Inquiry data.
138 *
139 * dev_type: SCSI device type to match, or T_ANY to match any
140 * device from the given vendor. Note that if there
141 * is a specific device type listed for a particular
142 * vendor, it must be listed before a T_ANY entry.
143 *
144 * max_pkt_size: Maximum packet size when talking to a device. Note
145 * that although large data sizes may be supported by
146 * the target device, they may not be supported by the
147 * OS or the controller.
148 *
149 * cdb_byte2: This specifies byte 2 (byte 1 when counting from 0)
150 * of the CDB. This is generally the WRITE BUFFER mode.
151 *
152 * cdb_byte2_last: This specifies byte 2 for the last chunk of the
153 * download.
154 *
155 * inc_cdb_buffer_id: Increment the buffer ID by 1 for each chunk sent
156 * down to the drive.
157 *
158 * inc_cdb_offset: Increment the offset field in the CDB with the byte
159 * offset into the firmware file.
160 *
161 * tur_status: Pay attention to whether the device is ready before
162 * upgrading the firmware, or not. See above for the
163 * values.
164 */
165 struct fw_vendor {
166 fw_vendor_t type;
167 const char *pattern;
168 int dev_type;
169 int max_pkt_size;
170 u_int8_t cdb_byte2;
171 u_int8_t cdb_byte2_last;
172 int inc_cdb_buffer_id;
173 int inc_cdb_offset;
174 fw_tur_status tur_status;
175 int timeout_ms;
176 fw_timeout_type timeout_type;
177 };
178
179 /*
180 * Vendor notes:
181 *
182 * HGST: The packets need to be sent in multiples of 4K.
183 *
184 * IBM: For LTO and TS drives, the buffer ID is ignored in mode 7 (and
185 * some other modes). It treats the request as a firmware download.
186 * The offset (and therefore the length of each chunk sent) needs
187 * to be a multiple of the offset boundary specified for firmware
188 * (buffer ID 4) in the read buffer command. At least for LTO-6,
189 * that seems to be 0, but using a 32K chunk size should satisfy
190 * most any alignment requirement.
191 *
192 * SmrtStor: Mode 5 is also supported, but since the firmware is 400KB or
193 * so, we can't fit it in a single request in most cases.
194 */
195 static struct fw_vendor vendors_list[] = {
196 {VENDOR_HGST, "HGST", T_DIRECT,
197 0x1000, 0x07, 0x07, 1, 0, FW_TUR_READY, WB_TIMEOUT, FW_TIMEOUT_DEFAULT},
198 {VENDOR_HITACHI, "HITACHI", T_ANY,
199 0x8000, 0x05, 0x05, 1, 0, FW_TUR_READY, WB_TIMEOUT, FW_TIMEOUT_DEFAULT},
200 {VENDOR_HP, "HP", T_ANY,
201 0x8000, 0x07, 0x07, 0, 1, FW_TUR_READY, WB_TIMEOUT, FW_TIMEOUT_DEFAULT},
202 {VENDOR_IBM, "IBM", T_SEQUENTIAL,
203 0x8000, 0x07, 0x07, 0, 1, FW_TUR_NA, 300 * 1000, FW_TIMEOUT_DEFAULT},
204 {VENDOR_IBM, "IBM", T_ANY,
205 0x8000, 0x05, 0x05, 1, 0, FW_TUR_READY, WB_TIMEOUT, FW_TIMEOUT_DEFAULT},
206 {VENDOR_PLEXTOR, "PLEXTOR", T_ANY,
207 0x2000, 0x04, 0x05, 0, 1, FW_TUR_READY, WB_TIMEOUT, FW_TIMEOUT_DEFAULT},
208 {VENDOR_QUALSTAR, "QUALSTAR", T_ANY,
209 0x2030, 0x05, 0x05, 0, 0, FW_TUR_READY, WB_TIMEOUT, FW_TIMEOUT_DEFAULT},
210 {VENDOR_QUANTUM, "QUANTUM", T_ANY,
211 0x2000, 0x04, 0x05, 0, 1, FW_TUR_READY, WB_TIMEOUT, FW_TIMEOUT_DEFAULT},
212 {VENDOR_SAMSUNG, "SAMSUNG", T_ANY,
213 0x8000, 0x07, 0x07, 0, 1, FW_TUR_READY, WB_TIMEOUT, FW_TIMEOUT_DEFAULT},
214 {VENDOR_SEAGATE, "SEAGATE", T_ANY,
215 0x8000, 0x07, 0x07, 0, 1, FW_TUR_READY, WB_TIMEOUT, FW_TIMEOUT_DEFAULT},
216 {VENDOR_SMART, "SmrtStor", T_DIRECT,
217 0x8000, 0x07, 0x07, 0, 1, FW_TUR_READY, WB_TIMEOUT, FW_TIMEOUT_DEFAULT},
218 {VENDOR_HGST, "WD", T_DIRECT,
219 0x1000, 0x07, 0x07, 1, 0, FW_TUR_READY, WB_TIMEOUT, FW_TIMEOUT_DEFAULT},
220 {VENDOR_HGST, "WDC", T_DIRECT,
221 0x1000, 0x07, 0x07, 1, 0, FW_TUR_READY, WB_TIMEOUT, FW_TIMEOUT_DEFAULT},
222
223 /*
224 * We match any ATA device. This is really just a placeholder,
225 * since we won't actually send a WRITE BUFFER with any of the
226 * listed parameters. If a SATA device is behind a SAS controller,
227 * the SCSI to ATA translation code (at least for LSI) doesn't
228 * generally translate a SCSI WRITE BUFFER into an ATA DOWNLOAD
229 * MICROCODE command. So, we use the SCSI ATA PASS_THROUGH command
230 * to send the ATA DOWNLOAD MICROCODE command instead.
231 */
232 {VENDOR_ATA, "ATA", T_ANY,
233 0x8000, 0x07, 0x07, 0, 1, FW_TUR_READY, WB_TIMEOUT,
234 FW_TIMEOUT_NO_PROBE},
235 {VENDOR_UNKNOWN, NULL, T_ANY,
236 0x0000, 0x00, 0x00, 0, 0, FW_TUR_NONE, WB_TIMEOUT, FW_TIMEOUT_DEFAULT}
237 };
238
239 struct fw_timeout_desc {
240 fw_timeout_type timeout_type;
241 const char *timeout_desc;
242 };
243
244 static const struct fw_timeout_desc fw_timeout_desc_table[] = {
245 { FW_TIMEOUT_DEFAULT, "the default" },
246 { FW_TIMEOUT_DEV_REPORTED, "recommended by this particular device" },
247 { FW_TIMEOUT_NO_PROBE, "the default" },
248 { FW_TIMEOUT_USER_SPEC, "what was specified on the command line" }
249 };
250
251 #ifndef ATA_DOWNLOAD_MICROCODE
252 #define ATA_DOWNLOAD_MICROCODE 0x92
253 #endif
254
255 #define USE_OFFSETS_FEATURE 0x3
256
257 #ifndef LOW_SECTOR_SIZE
258 #define LOW_SECTOR_SIZE 512
259 #endif
260
261 #define ATA_MAKE_LBA(o, p) \
262 ((((((o) / LOW_SECTOR_SIZE) >> 8) & 0xff) << 16) | \
263 ((((o) / LOW_SECTOR_SIZE) & 0xff) << 8) | \
264 ((((p) / LOW_SECTOR_SIZE) >> 8) & 0xff))
265
266 #define ATA_MAKE_SECTORS(p) (((p) / 512) & 0xff)
267
268 #ifndef UNKNOWN_MAX_PKT_SIZE
269 #define UNKNOWN_MAX_PKT_SIZE 0x8000
270 #endif
271
272 static struct fw_vendor *fw_get_vendor(struct cam_device *cam_dev,
273 struct ata_params *ident_buf);
274 static int fw_get_timeout(struct cam_device *cam_dev, struct fw_vendor *vp,
275 int task_attr, int retry_count, int timeout);
276 static int fw_validate_ibm(struct cam_device *dev, int retry_count,
277 int timeout, int fd, char *buf,
278 const char *fw_img_path, int quiet);
279 static char *fw_read_img(struct cam_device *dev, int retry_count,
280 int timeout, int quiet, const char *fw_img_path,
281 struct fw_vendor *vp, int *num_bytes);
282 static int fw_check_device_ready(struct cam_device *dev,
283 camcontrol_devtype devtype,
284 struct fw_vendor *vp, int printerrors,
285 int timeout);
286 static int fw_download_img(struct cam_device *cam_dev,
287 struct fw_vendor *vp, char *buf, int img_size,
288 int sim_mode, int printerrors, int quiet,
289 int retry_count, int timeout, const char */*name*/,
290 camcontrol_devtype devtype);
291
292 /*
293 * Find entry in vendors list that belongs to
294 * the vendor of given cam device.
295 */
296 static struct fw_vendor *
fw_get_vendor(struct cam_device * cam_dev,struct ata_params * ident_buf)297 fw_get_vendor(struct cam_device *cam_dev, struct ata_params *ident_buf)
298 {
299 char vendor[42];
300 struct fw_vendor *vp;
301
302 if (cam_dev == NULL)
303 return (NULL);
304
305 if (ident_buf != NULL) {
306 cam_strvis((u_char *)vendor, ident_buf->model,
307 sizeof(ident_buf->model), sizeof(vendor));
308 for (vp = vendors_list; vp->pattern != NULL; vp++) {
309 if (vp->type == VENDOR_ATA)
310 return (vp);
311 }
312 } else {
313 cam_strvis((u_char *)vendor, (u_char *)cam_dev->inq_data.vendor,
314 sizeof(cam_dev->inq_data.vendor), sizeof(vendor));
315 }
316 for (vp = vendors_list; vp->pattern != NULL; vp++) {
317 if (!cam_strmatch((const u_char *)vendor,
318 (const u_char *)vp->pattern, strlen(vendor))) {
319 if ((vp->dev_type == T_ANY)
320 || (vp->dev_type == SID_TYPE(&cam_dev->inq_data)))
321 break;
322 }
323 }
324 return (vp);
325 }
326
327 static int
fw_get_timeout(struct cam_device * cam_dev,struct fw_vendor * vp,int task_attr,int retry_count,int timeout)328 fw_get_timeout(struct cam_device *cam_dev, struct fw_vendor *vp,
329 int task_attr, int retry_count, int timeout)
330 {
331 struct scsi_report_supported_opcodes_one *one;
332 struct scsi_report_supported_opcodes_timeout *td;
333 uint8_t *buf = NULL;
334 uint32_t fill_len = 0, cdb_len = 0, rec_timeout = 0;
335 int retval = 0;
336
337 /*
338 * If the user has specified a timeout on the command line, we let
339 * him override any default or probed value.
340 */
341 if (timeout != 0) {
342 vp->timeout_type = FW_TIMEOUT_USER_SPEC;
343 vp->timeout_ms = timeout;
344 goto bailout;
345 }
346
347 /*
348 * Check to see whether we should probe for a timeout for this
349 * device.
350 */
351 if (vp->timeout_type == FW_TIMEOUT_NO_PROBE)
352 goto bailout;
353
354 retval = scsigetopcodes(/*device*/ cam_dev,
355 /*opcode_set*/ 1,
356 /*opcode*/ WRITE_BUFFER,
357 /*show_sa_errors*/ 1,
358 /*sa_set*/ 0,
359 /*service_action*/ 0,
360 /*timeout_desc*/ 1,
361 /*task_attr*/ task_attr,
362 /*retry_count*/ retry_count,
363 /*timeout*/ 10000,
364 /*verbose*/ 0,
365 /*fill_len*/ &fill_len,
366 /*data_ptr*/ &buf);
367 /*
368 * It isn't an error if we can't get a timeout descriptor. We just
369 * continue on with the default timeout.
370 */
371 if (retval != 0) {
372 retval = 0;
373 goto bailout;
374 }
375
376 /*
377 * Even if the drive didn't return a SCSI error, if we don't have
378 * enough data to contain the one opcode descriptor, the CDB
379 * structure and a timeout descriptor, we don't have the timeout
380 * value we're looking for. So we'll just fall back to the
381 * default value.
382 */
383 if (fill_len < (sizeof(*one) + sizeof(struct scsi_write_buffer) +
384 sizeof(*td)))
385 goto bailout;
386
387 one = (struct scsi_report_supported_opcodes_one *)buf;
388
389 /*
390 * If the drive claims to not support the WRITE BUFFER command...
391 * fall back to the default timeout value and let things fail on
392 * the actual firmware download.
393 */
394 if ((one->support & RSO_ONE_SUP_MASK) == RSO_ONE_SUP_NOT_SUP)
395 goto bailout;
396
397 cdb_len = scsi_2btoul(one->cdb_length);
398 td = (struct scsi_report_supported_opcodes_timeout *)
399 &buf[sizeof(*one) + cdb_len];
400
401 rec_timeout = scsi_4btoul(td->recommended_time);
402 /*
403 * If the recommended timeout is 0, then the device has probably
404 * returned a bogus value.
405 */
406 if (rec_timeout == 0)
407 goto bailout;
408
409 /* CAM timeouts are in ms */
410 rec_timeout *= 1000;
411
412 vp->timeout_ms = rec_timeout;
413 vp->timeout_type = FW_TIMEOUT_DEV_REPORTED;
414
415 bailout:
416 return (retval);
417 }
418
419 #define SVPD_IBM_FW_DESIGNATION 0x03
420
421 /*
422 * IBM LTO and TS tape drives have an INQUIRY VPD page 0x3 with the following
423 * format:
424 */
425 struct fw_ibm_tape_fw_designation {
426 uint8_t device;
427 uint8_t page_code;
428 uint8_t reserved;
429 uint8_t length;
430 uint8_t ascii_length;
431 uint8_t reserved2[3];
432 uint8_t load_id[4];
433 uint8_t fw_rev[4];
434 uint8_t ptf_number[4];
435 uint8_t patch_number[4];
436 uint8_t ru_name[8];
437 uint8_t lib_seq_num[5];
438 };
439
440 /*
441 * The firmware for IBM tape drives has the following header format. The
442 * load_id and ru_name in the header file should match what is returned in
443 * VPD page 0x3.
444 */
445 struct fw_ibm_tape_fw_header {
446 uint8_t unspec[4];
447 uint8_t length[4]; /* Firmware and header! */
448 uint8_t load_id[4];
449 uint8_t fw_rev[4];
450 uint8_t reserved[8];
451 uint8_t ru_name[8];
452 };
453
454 static int
fw_validate_ibm(struct cam_device * dev,int retry_count,int timeout,int fd,char * buf,const char * fw_img_path,int quiet)455 fw_validate_ibm(struct cam_device *dev, int retry_count, int timeout, int fd,
456 char *buf, const char *fw_img_path, int quiet)
457 {
458 union ccb *ccb;
459 struct fw_ibm_tape_fw_designation vpd_page;
460 struct fw_ibm_tape_fw_header *header;
461 char drive_rev[sizeof(vpd_page.fw_rev) + 1];
462 char file_rev[sizeof(vpd_page.fw_rev) + 1];
463 int retval = 1;
464
465 ccb = cam_getccb(dev);
466 if (ccb == NULL) {
467 warnx("couldn't allocate CCB");
468 goto bailout;
469 }
470
471 /* cam_getccb cleans up the header, caller has to zero the payload */
472 CCB_CLEAR_ALL_EXCEPT_HDR(&ccb->csio);
473
474 bzero(&vpd_page, sizeof(vpd_page));
475
476 scsi_inquiry(&ccb->csio,
477 /*retries*/ retry_count,
478 /*cbfcnp*/ NULL,
479 /* tag_action */ MSG_SIMPLE_Q_TAG,
480 /* inq_buf */ (u_int8_t *)&vpd_page,
481 /* inq_len */ sizeof(vpd_page),
482 /* evpd */ 1,
483 /* page_code */ SVPD_IBM_FW_DESIGNATION,
484 /* sense_len */ SSD_FULL_SIZE,
485 /* timeout */ timeout ? timeout : 5000);
486
487 /* Disable freezing the device queue */
488 ccb->ccb_h.flags |= CAM_DEV_QFRZDIS;
489
490 if (retry_count != 0)
491 ccb->ccb_h.flags |= CAM_PASS_ERR_RECOVER;
492
493 if (cam_send_ccb(dev, ccb) < 0) {
494 warn("error getting firmware designation page");
495
496 cam_error_print(dev, ccb, CAM_ESF_ALL,
497 CAM_EPF_ALL, stderr);
498
499 cam_freeccb(ccb);
500 ccb = NULL;
501 goto bailout;
502 }
503
504 if ((ccb->ccb_h.status & CAM_STATUS_MASK) != CAM_REQ_CMP) {
505 cam_error_print(dev, ccb, CAM_ESF_ALL,
506 CAM_EPF_ALL, stderr);
507 goto bailout;
508 }
509
510 /*
511 * Read the firmware header only.
512 */
513 if (read(fd, buf, sizeof(*header)) != sizeof(*header)) {
514 warn("unable to read %zu bytes from %s", sizeof(*header),
515 fw_img_path);
516 goto bailout;
517 }
518
519 /* Rewind the file back to 0 for the full file read. */
520 if (lseek(fd, 0, SEEK_SET) == -1) {
521 warn("Unable to lseek");
522 goto bailout;
523 }
524
525 header = (struct fw_ibm_tape_fw_header *)buf;
526
527 bzero(drive_rev, sizeof(drive_rev));
528 bcopy(vpd_page.fw_rev, drive_rev, sizeof(vpd_page.fw_rev));
529 bzero(file_rev, sizeof(file_rev));
530 bcopy(header->fw_rev, file_rev, sizeof(header->fw_rev));
531
532 if (quiet == 0) {
533 fprintf(stdout, "Current Drive Firmware version: %s\n",
534 drive_rev);
535 fprintf(stdout, "Firmware File version: %s\n", file_rev);
536 }
537
538 /*
539 * For IBM tape drives the load ID and RU name reported by the
540 * drive should match what is in the firmware file.
541 */
542 if (bcmp(vpd_page.load_id, header->load_id,
543 MIN(sizeof(vpd_page.load_id), sizeof(header->load_id))) != 0) {
544 warnx("Drive Firmware load ID 0x%x does not match firmware "
545 "file load ID 0x%x", scsi_4btoul(vpd_page.load_id),
546 scsi_4btoul(header->load_id));
547 goto bailout;
548 }
549
550 if (bcmp(vpd_page.ru_name, header->ru_name,
551 MIN(sizeof(vpd_page.ru_name), sizeof(header->ru_name))) != 0) {
552 warnx("Drive Firmware RU name 0x%jx does not match firmware "
553 "file RU name 0x%jx",
554 (uintmax_t)scsi_8btou64(vpd_page.ru_name),
555 (uintmax_t)scsi_8btou64(header->ru_name));
556 goto bailout;
557 }
558 if (quiet == 0)
559 fprintf(stdout, "Firmware file is valid for this drive.\n");
560 retval = 0;
561 bailout:
562 cam_freeccb(ccb);
563
564 return (retval);
565 }
566
567 /*
568 * Allocate a buffer and read fw image file into it
569 * from given path. Number of bytes read is stored
570 * in num_bytes.
571 */
572 static char *
fw_read_img(struct cam_device * dev,int retry_count,int timeout,int quiet,const char * fw_img_path,struct fw_vendor * vp,int * num_bytes)573 fw_read_img(struct cam_device *dev, int retry_count, int timeout, int quiet,
574 const char *fw_img_path, struct fw_vendor *vp, int *num_bytes)
575 {
576 int fd;
577 struct stat stbuf;
578 char *buf;
579 off_t img_size;
580 int skip_bytes = 0;
581
582 if ((fd = open(fw_img_path, O_RDONLY)) < 0) {
583 warn("Could not open image file %s", fw_img_path);
584 return (NULL);
585 }
586 if (fstat(fd, &stbuf) < 0) {
587 warn("Could not stat image file %s", fw_img_path);
588 goto bailout1;
589 }
590 if ((img_size = stbuf.st_size) == 0) {
591 warnx("Zero length image file %s", fw_img_path);
592 goto bailout1;
593 }
594 if ((buf = malloc(img_size)) == NULL) {
595 warnx("Could not allocate buffer to read image file %s",
596 fw_img_path);
597 goto bailout1;
598 }
599 /* Skip headers if applicable. */
600 switch (vp->type) {
601 case VENDOR_SEAGATE:
602 if (read(fd, buf, 16) != 16) {
603 warn("Could not read image file %s", fw_img_path);
604 goto bailout;
605 }
606 if (lseek(fd, 0, SEEK_SET) == -1) {
607 warn("Unable to lseek");
608 goto bailout;
609 }
610 if ((strncmp(buf, "SEAGATE,SEAGATE ", 16) == 0) ||
611 (img_size % 512 == 80))
612 skip_bytes = 80;
613 break;
614 case VENDOR_QUALSTAR:
615 skip_bytes = img_size % 1030;
616 break;
617 case VENDOR_IBM: {
618 if (vp->dev_type != T_SEQUENTIAL)
619 break;
620 if (fw_validate_ibm(dev, retry_count, timeout, fd, buf,
621 fw_img_path, quiet) != 0)
622 goto bailout;
623 break;
624 }
625 default:
626 break;
627 }
628 if (skip_bytes != 0) {
629 fprintf(stdout, "Skipping %d byte header.\n", skip_bytes);
630 if (lseek(fd, skip_bytes, SEEK_SET) == -1) {
631 warn("Could not lseek");
632 goto bailout;
633 }
634 img_size -= skip_bytes;
635 }
636 /* Read image into a buffer. */
637 if (read(fd, buf, img_size) != img_size) {
638 warn("Could not read image file %s", fw_img_path);
639 goto bailout;
640 }
641 *num_bytes = img_size;
642 close(fd);
643 return (buf);
644 bailout:
645 free(buf);
646 bailout1:
647 close(fd);
648 *num_bytes = 0;
649 return (NULL);
650 }
651
652 /*
653 * Returns 0 for "success", where success means that the device has met the
654 * requirement in the vendor structure for being ready or not ready when
655 * firmware is downloaded.
656 *
657 * Returns 1 for a failure to be ready to accept a firmware download.
658 * (e.g., a drive needs to be ready, but returns not ready)
659 *
660 * Returns -1 for any other failure.
661 */
662 static int
fw_check_device_ready(struct cam_device * dev,camcontrol_devtype devtype,struct fw_vendor * vp,int printerrors,int timeout)663 fw_check_device_ready(struct cam_device *dev, camcontrol_devtype devtype,
664 struct fw_vendor *vp, int printerrors, int timeout)
665 {
666 union ccb *ccb;
667 int retval = 0;
668 int16_t *ptr = NULL;
669 size_t dxfer_len = 0;
670
671 if ((ccb = cam_getccb(dev)) == NULL) {
672 warnx("Could not allocate CCB");
673 retval = -1;
674 goto bailout;
675 }
676
677 CCB_CLEAR_ALL_EXCEPT_HDR(ccb);
678
679 if (devtype != CC_DT_SCSI) {
680 dxfer_len = sizeof(struct ata_params);
681
682 ptr = (uint16_t *)malloc(dxfer_len);
683 if (ptr == NULL) {
684 warnx("can't malloc memory for identify");
685 retval = -1;
686 goto bailout;
687 }
688 bzero(ptr, dxfer_len);
689 }
690
691 switch (devtype) {
692 case CC_DT_SCSI:
693 scsi_test_unit_ready(&ccb->csio,
694 /*retries*/ 0,
695 /*cbfcnp*/ NULL,
696 /*tag_action*/ MSG_SIMPLE_Q_TAG,
697 /*sense_len*/ SSD_FULL_SIZE,
698 /*timeout*/ 5000);
699 break;
700 case CC_DT_SATL:
701 case CC_DT_ATA: {
702 retval = build_ata_cmd(ccb,
703 /*retries*/ 1,
704 /*flags*/ CAM_DIR_IN,
705 /*tag_action*/ MSG_SIMPLE_Q_TAG,
706 /*protocol*/ AP_PROTO_PIO_IN,
707 /*ata_flags*/ AP_FLAG_BYT_BLOK_BLOCKS |
708 AP_FLAG_TLEN_SECT_CNT |
709 AP_FLAG_TDIR_FROM_DEV,
710 /*features*/ 0,
711 /*sector_count*/ dxfer_len / 512,
712 /*lba*/ 0,
713 /*command*/ ATA_ATA_IDENTIFY,
714 /*auxiliary*/ 0,
715 /*data_ptr*/ (uint8_t *)ptr,
716 /*dxfer_len*/ dxfer_len,
717 /*cdb_storage*/ NULL,
718 /*cdb_storage_len*/ 0,
719 /*sense_len*/ SSD_FULL_SIZE,
720 /*timeout*/ timeout ? timeout : 30 * 1000,
721 /*is48bit*/ 0,
722 /*devtype*/ devtype);
723 if (retval != 0) {
724 retval = -1;
725 warnx("%s: build_ata_cmd() failed, likely "
726 "programmer error", __func__);
727 goto bailout;
728 }
729 break;
730 }
731 default:
732 warnx("Unknown disk type %d", devtype);
733 retval = -1;
734 goto bailout;
735 break; /*NOTREACHED*/
736 }
737
738 ccb->ccb_h.flags |= CAM_DEV_QFRZDIS;
739
740 retval = cam_send_ccb(dev, ccb);
741 if (retval != 0) {
742 warn("error sending %s CCB", (devtype == CC_DT_SCSI) ?
743 "Test Unit Ready" : "Identify");
744 retval = -1;
745 goto bailout;
746 }
747
748 if (((ccb->ccb_h.status & CAM_STATUS_MASK) != CAM_REQ_CMP)
749 && (vp->tur_status == FW_TUR_READY)) {
750 warnx("Device is not ready");
751 if (printerrors)
752 cam_error_print(dev, ccb, CAM_ESF_ALL,
753 CAM_EPF_ALL, stderr);
754 retval = 1;
755 goto bailout;
756 } else if (((ccb->ccb_h.status & CAM_STATUS_MASK) == CAM_REQ_CMP)
757 && (vp->tur_status == FW_TUR_NOT_READY)) {
758 warnx("Device cannot have media loaded when firmware is "
759 "downloaded");
760 retval = 1;
761 goto bailout;
762 }
763 bailout:
764 free(ptr);
765 cam_freeccb(ccb);
766
767 return (retval);
768 }
769
770 /*
771 * After the firmware is downloaded, we know the sense data has changed (or is
772 * likely to change since it contains the firmware version). Rescan the target
773 * with a flag to tell the kernel it's OK. This allows us to continnue using the
774 * old periph/disk in the kernel, which is less disruptive. We rescan the target
775 * because multilun devices usually update all the luns after the first firmware
776 * download.
777 */
778 static int
fw_rescan_target(struct cam_device * dev,bool printerrors,bool sim_mode)779 fw_rescan_target(struct cam_device *dev, bool printerrors, bool sim_mode)
780 {
781 union ccb ccb;
782 int fd;
783
784 printf("Rescanning target %d:%d:* to pick up new fw revision / parameters.\n",
785 dev->path_id, dev->target_id);
786 if (sim_mode)
787 return (0);
788
789 /* Can only send XPT_SCAN_TGT via /dev/xpt, not pass device in *dev */
790 if ((fd = open(XPT_DEVICE, O_RDWR)) < 0) {
791 warnx("error opening transport layer device %s\n",
792 XPT_DEVICE);
793 warn("%s", XPT_DEVICE);
794 return (1);
795 }
796
797 /* Rescan the target */
798 bzero(&ccb, sizeof(union ccb));
799 ccb.ccb_h.func_code = XPT_SCAN_TGT;
800 ccb.ccb_h.path_id = dev->path_id;
801 ccb.ccb_h.target_id = dev->target_id;
802 ccb.ccb_h.target_lun = CAM_LUN_WILDCARD;
803 ccb.crcn.flags = CAM_EXPECT_INQ_CHANGE;
804 ccb.ccb_h.pinfo.priority = 5; /* run this at a low priority */
805
806 if (ioctl(fd, CAMIOCOMMAND, &ccb) < 0) {
807 warn("CAMIOCOMMAND XPT_SCAN_TGT ioctl failed");
808 close(fd);
809 return (1);
810 }
811 if ((ccb.ccb_h.status & CAM_STATUS_MASK) != CAM_REQ_CMP) {
812 warn("Can't send rescan lun");
813 if (printerrors)
814 cam_error_print(dev, &ccb, CAM_ESF_ALL, CAM_EPF_ALL,
815 stderr);
816 close(fd);
817 return (1);
818 }
819 close(fd);
820 return (0);
821 }
822
823 /*
824 * Download firmware stored in buf to cam_dev. If simulation mode
825 * is enabled, only show what packet sizes would be sent to the
826 * device but do not sent any actual packets
827 */
828 static int
fw_download_img(struct cam_device * cam_dev,struct fw_vendor * vp,char * buf,int img_size,int sim_mode,int printerrors,int quiet,int retry_count,int timeout,const char * imgname,camcontrol_devtype devtype)829 fw_download_img(struct cam_device *cam_dev, struct fw_vendor *vp,
830 char *buf, int img_size, int sim_mode, int printerrors, int quiet,
831 int retry_count, int timeout, const char *imgname,
832 camcontrol_devtype devtype)
833 {
834 struct scsi_write_buffer cdb;
835 progress_t progress;
836 int size = 0;
837 union ccb *ccb = NULL;
838 int pkt_count = 0;
839 int max_pkt_size;
840 u_int32_t pkt_size = 0;
841 char *pkt_ptr = buf;
842 u_int32_t offset;
843 int last_pkt = 0;
844 int retval = 0;
845
846 /*
847 * Check to see whether the device is ready to accept a firmware
848 * download.
849 */
850 retval = fw_check_device_ready(cam_dev, devtype, vp, printerrors,
851 timeout);
852 if (retval != 0)
853 goto bailout;
854
855 if ((ccb = cam_getccb(cam_dev)) == NULL) {
856 warnx("Could not allocate CCB");
857 retval = 1;
858 goto bailout;
859 }
860
861 CCB_CLEAR_ALL_EXCEPT_HDR(ccb);
862
863 max_pkt_size = vp->max_pkt_size;
864 if (max_pkt_size == 0)
865 max_pkt_size = UNKNOWN_MAX_PKT_SIZE;
866
867 pkt_size = max_pkt_size;
868 progress_init(&progress, imgname, size = img_size);
869 /* Download single fw packets. */
870 do {
871 if (img_size <= max_pkt_size) {
872 last_pkt = 1;
873 pkt_size = img_size;
874 }
875 progress_update(&progress, size - img_size);
876 if (((sim_mode == 0) && (quiet == 0))
877 || ((sim_mode != 0) && (printerrors == 0)))
878 progress_draw(&progress);
879 bzero(&cdb, sizeof(cdb));
880 switch (devtype) {
881 case CC_DT_SCSI:
882 cdb.opcode = WRITE_BUFFER;
883 cdb.control = 0;
884 /* Parameter list length. */
885 scsi_ulto3b(pkt_size, &cdb.length[0]);
886 offset = vp->inc_cdb_offset ? (pkt_ptr - buf) : 0;
887 scsi_ulto3b(offset, &cdb.offset[0]);
888 cdb.byte2 = last_pkt ? vp->cdb_byte2_last :
889 vp->cdb_byte2;
890 cdb.buffer_id = vp->inc_cdb_buffer_id ? pkt_count : 0;
891 /* Zero out payload of ccb union after ccb header. */
892 CCB_CLEAR_ALL_EXCEPT_HDR(&ccb->csio);
893 /*
894 * Copy previously constructed cdb into ccb_scsiio
895 * struct.
896 */
897 bcopy(&cdb, &ccb->csio.cdb_io.cdb_bytes[0],
898 sizeof(struct scsi_write_buffer));
899 /* Fill rest of ccb_scsiio struct. */
900 cam_fill_csio(&ccb->csio, /* ccb_scsiio*/
901 retry_count, /* retries*/
902 NULL, /* cbfcnp*/
903 CAM_DIR_OUT | CAM_DEV_QFRZDIS, /* flags*/
904 CAM_TAG_ACTION_NONE, /* tag_action*/
905 (u_char *)pkt_ptr, /* data_ptr*/
906 pkt_size, /* dxfer_len*/
907 SSD_FULL_SIZE, /* sense_len*/
908 sizeof(struct scsi_write_buffer), /* cdb_len*/
909 timeout ? timeout : WB_TIMEOUT); /* timeout*/
910 break;
911 case CC_DT_ATA:
912 case CC_DT_SATL: {
913 uint32_t off;
914
915 off = (uint32_t)(pkt_ptr - buf);
916
917 retval = build_ata_cmd(ccb,
918 /*retry_count*/ retry_count,
919 /*flags*/ CAM_DIR_OUT | CAM_DEV_QFRZDIS,
920 /*tag_action*/ CAM_TAG_ACTION_NONE,
921 /*protocol*/ AP_PROTO_PIO_OUT,
922 /*ata_flags*/ AP_FLAG_BYT_BLOK_BYTES |
923 AP_FLAG_TLEN_SECT_CNT |
924 AP_FLAG_TDIR_TO_DEV,
925 /*features*/ USE_OFFSETS_FEATURE,
926 /*sector_count*/ ATA_MAKE_SECTORS(pkt_size),
927 /*lba*/ ATA_MAKE_LBA(off, pkt_size),
928 /*command*/ ATA_DOWNLOAD_MICROCODE,
929 /*auxiliary*/ 0,
930 /*data_ptr*/ (uint8_t *)pkt_ptr,
931 /*dxfer_len*/ pkt_size,
932 /*cdb_storage*/ NULL,
933 /*cdb_storage_len*/ 0,
934 /*sense_len*/ SSD_FULL_SIZE,
935 /*timeout*/ timeout ? timeout : WB_TIMEOUT,
936 /*is48bit*/ 0,
937 /*devtype*/ devtype);
938
939 if (retval != 0) {
940 warnx("%s: build_ata_cmd() failed, likely "
941 "programmer error", __func__);
942 goto bailout;
943 }
944 break;
945 }
946 default:
947 warnx("Unknown device type %d", devtype);
948 retval = 1;
949 goto bailout;
950 break; /*NOTREACHED*/
951 }
952 if (!sim_mode) {
953 /* Execute the command. */
954 if (cam_send_ccb(cam_dev, ccb) < 0 ||
955 (ccb->ccb_h.status & CAM_STATUS_MASK) !=
956 CAM_REQ_CMP) {
957 warnx("Error writing image to device");
958 if (printerrors)
959 cam_error_print(cam_dev, ccb,
960 CAM_ESF_ALL, CAM_EPF_ALL, stderr);
961 retval = 1;
962 goto bailout;
963 }
964 } else if (printerrors) {
965 cam_error_print(cam_dev, ccb, CAM_ESF_COMMAND, 0,
966 stdout);
967 }
968
969 /* Prepare next round. */
970 pkt_count++;
971 pkt_ptr += pkt_size;
972 img_size -= pkt_size;
973 } while(!last_pkt);
974 bailout:
975 if (quiet == 0)
976 progress_complete(&progress, size - img_size);
977 cam_freeccb(ccb);
978 if (retval == 0) {
979 fw_rescan_target(cam_dev, printerrors, sim_mode);
980 }
981 return (retval);
982 }
983
984 int
fwdownload(struct cam_device * device,int argc,char ** argv,char * combinedopt,int printerrors,int task_attr,int retry_count,int timeout)985 fwdownload(struct cam_device *device, int argc, char **argv,
986 char *combinedopt, int printerrors, int task_attr, int retry_count,
987 int timeout)
988 {
989 union ccb *ccb = NULL;
990 struct fw_vendor *vp;
991 char *fw_img_path = NULL;
992 struct ata_params *ident_buf = NULL;
993 camcontrol_devtype devtype;
994 char *buf = NULL;
995 int img_size;
996 int c;
997 int sim_mode = 0;
998 int confirmed = 0;
999 int quiet = 0;
1000 int retval = 0;
1001
1002 while ((c = getopt(argc, argv, combinedopt)) != -1) {
1003 switch (c) {
1004 case 'f':
1005 fw_img_path = optarg;
1006 break;
1007 case 'q':
1008 quiet = 1;
1009 break;
1010 case 's':
1011 sim_mode = 1;
1012 break;
1013 case 'y':
1014 confirmed = 1;
1015 break;
1016 default:
1017 break;
1018 }
1019 }
1020
1021 if (fw_img_path == NULL)
1022 errx(1, "you must specify a firmware image file using -f "
1023 "option");
1024
1025 retval = get_device_type(device, retry_count, timeout, printerrors,
1026 &devtype);
1027 if (retval != 0)
1028 errx(1, "Unable to determine device type");
1029
1030 if ((devtype == CC_DT_ATA)
1031 || (devtype == CC_DT_SATL)) {
1032 ccb = cam_getccb(device);
1033 if (ccb == NULL) {
1034 warnx("couldn't allocate CCB");
1035 retval = 1;
1036 goto bailout;
1037 }
1038
1039 if (ata_do_identify(device, retry_count, timeout, ccb,
1040 &ident_buf) != 0) {
1041 retval = 1;
1042 goto bailout;
1043 }
1044 } else if (devtype != CC_DT_SCSI)
1045 errx(1, "Unsupported device type %d", devtype);
1046
1047 vp = fw_get_vendor(device, ident_buf);
1048 /*
1049 * Bail out if we have an unknown vendor and this isn't an ATA
1050 * disk. For a SCSI disk, we have no chance of working properly
1051 * with the default values in the VENDOR_UNKNOWN case. For an ATA
1052 * disk connected via an ATA transport, we may work for drives that
1053 * support the ATA_DOWNLOAD_MICROCODE command.
1054 */
1055 if (((vp == NULL)
1056 || (vp->type == VENDOR_UNKNOWN))
1057 && (devtype == CC_DT_SCSI))
1058 errx(1, "Unsupported device");
1059
1060 retval = fw_get_timeout(device, vp, task_attr, retry_count, timeout);
1061 if (retval != 0) {
1062 warnx("Unable to get a firmware download timeout value");
1063 goto bailout;
1064 }
1065
1066 buf = fw_read_img(device, retry_count, timeout, quiet, fw_img_path,
1067 vp, &img_size);
1068 if (buf == NULL) {
1069 retval = 1;
1070 goto bailout;
1071 }
1072
1073 if (!confirmed) {
1074 fprintf(stdout, "You are about to download firmware image (%s)"
1075 " into the following device:\n",
1076 fw_img_path);
1077 if (devtype == CC_DT_SCSI) {
1078 if (scsidoinquiry(device, argc, argv, combinedopt,
1079 MSG_SIMPLE_Q_TAG, 0, 5000) != 0) {
1080 warnx("Error sending inquiry");
1081 retval = 1;
1082 goto bailout;
1083 }
1084 } else {
1085 printf("%s%d: ", device->device_name,
1086 device->dev_unit_num);
1087 ata_print_ident(ident_buf);
1088 camxferrate(device);
1089 free(ident_buf);
1090 }
1091 fprintf(stdout, "Using a timeout of %u ms, which is %s.\n",
1092 vp->timeout_ms,
1093 fw_timeout_desc_table[vp->timeout_type].timeout_desc);
1094 fprintf(stdout, "\nIt may damage your drive. ");
1095 if (!get_confirmation()) {
1096 retval = 1;
1097 goto bailout;
1098 }
1099 }
1100 if ((sim_mode != 0) && (quiet == 0))
1101 fprintf(stdout, "Running in simulation mode\n");
1102
1103 if (fw_download_img(device, vp, buf, img_size, sim_mode, printerrors,
1104 quiet, retry_count, vp->timeout_ms, fw_img_path, devtype) != 0) {
1105 fprintf(stderr, "Firmware download failed\n");
1106 retval = 1;
1107 goto bailout;
1108 } else if (quiet == 0)
1109 fprintf(stdout, "Firmware download successful\n");
1110
1111 bailout:
1112 cam_freeccb(ccb);
1113 free(buf);
1114 return (retval);
1115 }
1116
1117