1 /* $OpenBSD: mmc.c,v 1.30 2015/01/16 06:40:06 deraadt Exp $ */ 2 /* 3 * Copyright (c) 2006 Michael Coulter <mjc@openbsd.org> 4 * 5 * Permission to use, copy, modify, and distribute this software for any 6 * purpose with or without fee is hereby granted, provided that the above 7 * copyright notice and this permission notice appear in all copies. 8 * 9 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 10 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 11 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 12 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 13 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 14 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 15 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 16 */ 17 18 #include <sys/limits.h> 19 #include <sys/types.h> 20 #include <sys/scsiio.h> 21 #include <sys/param.h> /* setbit, isset */ 22 #include <scsi/cd.h> 23 #include <scsi/scsi_all.h> 24 #include <scsi/scsi_disk.h> 25 #include <err.h> 26 #include <errno.h> 27 #include <fcntl.h> 28 #include <stdio.h> 29 #include <string.h> 30 #include <unistd.h> 31 #include "extern.h" 32 33 extern int fd; 34 extern u_int8_t mediacap[]; 35 extern char *cdname; 36 extern int verbose; 37 38 #define SCSI_GET_CONFIGURATION 0x46 39 40 #define MMC_FEATURE_HDR_LEN 8 41 42 static const struct { 43 u_int16_t id; 44 char *name; 45 } mmc_feature[] = { 46 { 0x0000, "Profile List" }, 47 { 0x0001, "Core" }, 48 { 0x0002, "Morphing" }, 49 { 0x0003, "Removable Medium" }, 50 { 0x0004, "Write Protect" }, 51 { 0x0010, "Random Readable" }, 52 { 0x001d, "Multi-Read" }, 53 { 0x001e, "CD Read" }, 54 { 0x001f, "DVD Read" }, 55 { 0x0020, "Random Writable" }, 56 { 0x0021, "Incremental Streaming Writable" }, 57 { 0x0022, "Sector Erasable" }, 58 { 0x0023, "Formattable" }, 59 { 0x0024, "Hardware Defect Management" }, 60 { 0x0025, "Write Once" }, 61 { 0x0026, "Restricted Overwrite" }, 62 { 0x0027, "CD-RW CAV Write" }, 63 { 0x0028, "MRW" }, 64 { 0x0029, "Enhanced Defect Reporting" }, 65 { 0x002a, "DVD+RW" }, 66 { 0x002b, "DVD+R" }, 67 { 0x002c, "Rigid Restricted Overwrite" }, 68 { 0x002d, "CD Track at Once (TAO)" }, 69 { 0x002e, "CD Mastering (Session at Once)" }, 70 { 0x002f, "DVD-RW Write" }, 71 { 0x0030, "DDCD-ROM (Legacy)" }, 72 { 0x0031, "DDCD-R (Legacy)" }, 73 { 0x0032, "DDCD-RW (Legacy)" }, 74 { 0x0033, "Layer Jump Recording" }, 75 { 0x0037, "CD-RW Media Write Support" }, 76 { 0x0038, "BD-R Pseudo-Overwrite (POW)" }, 77 { 0x003a, "DVD+RW Dual Layer" }, 78 { 0x003b, "DVD+R Dual Layer" }, 79 { 0x0040, "BD Read" }, 80 { 0x0041, "BD Write" }, 81 { 0x0042, "Timely Safe Recording (TSR)" }, 82 { 0x0050, "HD DVD Read" }, 83 { 0x0051, "HD DVD Write" }, 84 { 0x0080, "Hybrid Disc" }, 85 { 0x0100, "Power Management" }, 86 { 0x0101, "S.M.A.R.T." }, 87 { 0x0102, "Embedded Changer" }, 88 { 0x0103, "CD Audio External Play (Legacy)" }, 89 { 0x0104, "Microcode Upgrade" }, 90 { 0x0105, "Timeout" }, 91 { 0x0106, "DVD CSS" }, 92 { 0x0107, "Real Time Streaming" }, 93 { 0x0108, "Drive Serial Number" }, 94 { 0x0109, "Media Serial Number" }, 95 { 0x010a, "Disc Control Blocks (DCBs)" }, 96 { 0x010b, "DVD CPRM" }, 97 { 0x010c, "Firmware Information" }, 98 { 0x010d, "AACS" }, 99 { 0x0110, "VCPS" }, 100 { 0, NULL } 101 }; 102 103 static const struct { 104 u_int16_t id; 105 char *name; 106 } mmc_profile[] = { 107 { 0x0001, "Re-writable disk, capable of changing behaviour" }, 108 { 0x0002, "Re-writable, with removable media" }, 109 { 0x0003, "Magneto-Optical disk with sector erase capability" }, 110 { 0x0004, "Optical write once" }, 111 { 0x0005, "Advance Storage -- Magneto-Optical" }, 112 { 0x0008, "Read only Compact Disc" }, 113 { 0x0009, "Write once Compact Disc" }, 114 { 0x000a, "Re-writable Compact Disc" }, 115 { 0x0010, "Read only DVD" }, 116 { 0x0011, "Write once DVD using Sequential recording" }, 117 { 0x0012, "Re-writable DVD" }, 118 { 0x0013, "Re-recordable DVD using Restricted Overwrite" }, 119 { 0x0014, "Re-recordable DVD using Sequential recording" }, 120 { 0x0015, "Dual Layer DVD-R using Sequential recording" }, 121 { 0x0016, "Dual Layer DVD-R using Layer Jump recording" }, 122 { 0x001a, "DVD+ReWritable" }, 123 { 0x001b, "DVD+Recordable" }, 124 { 0x0020, "DDCD-ROM" }, 125 { 0x0021, "DDCD-R" }, 126 { 0x0022, "DDCD-RW" }, 127 { 0x002a, "DVD+Rewritable Dual Layer" }, 128 { 0x002b, "DVD+Recordable Dual Layer" }, 129 { 0x003e, "Blu-ray Disc ROM" }, 130 { 0x003f, "Blu-ray Disc Recordable -- Sequential Recording Mode" }, 131 { 0x0040, "Blu-ray Disc Recordable -- Random Recording Mode" }, 132 { 0x0041, "Blu-ray Disc Rewritable" }, 133 { 0x004e, "Read-only HD DVD" }, 134 { 0x004f, "Write-once HD DVD" }, 135 { 0x0050, "Rewritable HD DVD" }, 136 { 0, NULL } 137 }; 138 139 int 140 get_media_type(void) 141 { 142 scsireq_t scr; 143 char buf[32]; 144 u_char disctype; 145 int rv, error; 146 147 rv = MEDIATYPE_UNKNOWN; 148 memset(buf, 0, sizeof(buf)); 149 memset(&scr, 0, sizeof(scr)); 150 151 scr.cmd[0] = READ_TOC; 152 scr.cmd[1] = 0x2; /* MSF */ 153 scr.cmd[2] = 0x4; /* ATIP */ 154 scr.cmd[8] = 0x20; 155 156 scr.flags = SCCMD_ESCAPE | SCCMD_READ; 157 scr.databuf = buf; 158 scr.datalen = sizeof(buf); 159 scr.cmdlen = 10; 160 scr.timeout = 120000; 161 scr.senselen = SENSEBUFLEN; 162 163 error = ioctl(fd, SCIOCCOMMAND, &scr); 164 if (error != -1 && scr.retsts == SCCMD_OK && scr.datalen_used > 7) { 165 disctype = (buf[6] >> 6) & 0x1; 166 if (disctype == 0) 167 rv = MEDIATYPE_CDR; 168 else if (disctype == 1) 169 rv = MEDIATYPE_CDRW; 170 } 171 172 return (rv); 173 } 174 175 int 176 get_media_capabilities(u_int8_t *cap, int rt) 177 { 178 scsireq_t scr; 179 u_char buf[4096]; 180 u_int32_t i, dlen; 181 u_int16_t feature, profile, tmp; 182 u_int8_t feature_len; 183 int current, error, j, k; 184 185 memset(cap, 0, MMC_FEATURE_MAX / NBBY); 186 memset(buf, 0, sizeof(buf)); 187 memset(&scr, 0, sizeof(scr)); 188 189 scr.cmd[0] = SCSI_GET_CONFIGURATION; 190 scr.cmd[1] = rt; 191 tmp = htobe16(sizeof(buf)); 192 memcpy(scr.cmd + 7, &tmp, sizeof(u_int16_t)); 193 194 scr.flags = SCCMD_ESCAPE | SCCMD_READ; 195 scr.databuf = buf; 196 scr.datalen = sizeof(buf); 197 scr.cmdlen = 10; 198 scr.timeout = 120000; 199 scr.senselen = SENSEBUFLEN; 200 201 error = ioctl(fd, SCIOCCOMMAND, &scr); 202 if (error == -1 || scr.retsts != SCCMD_OK) 203 return (-1); 204 if (scr.datalen_used < MMC_FEATURE_HDR_LEN) 205 return (-1); /* Can't get the header. */ 206 207 /* Include the whole header in the length. */ 208 dlen = betoh32(*(u_int32_t *)buf) + 4; 209 if (dlen > scr.datalen_used) 210 dlen = scr.datalen_used; 211 212 if (verbose > 1) 213 printf("Features:\n"); 214 for (i = MMC_FEATURE_HDR_LEN; i + 3 < dlen; i += feature_len) { 215 feature_len = buf[i + 3] + 4; 216 if (feature_len + i > dlen) 217 break; 218 219 feature = betoh16(*(u_int16_t *)(buf + i)); 220 if (feature >= MMC_FEATURE_MAX) 221 break; 222 223 if (verbose > 1) { 224 printf("0x%04x", feature); 225 for (j = 0; mmc_feature[j].name != NULL; j++) 226 if (feature == mmc_feature[j].id) 227 break; 228 if (mmc_feature[j].name == NULL) 229 printf(" <Undocumented>"); 230 else 231 printf(" %s", mmc_feature[j].name); 232 if (feature_len > 4) 233 printf(" (%d bytes of data)", feature_len - 4); 234 printf("\n"); 235 if (verbose > 2) { 236 printf(" "); 237 for (j = i; j < i + feature_len; j++) { 238 printf("%02x", buf[j]); 239 if ((j + 1) == (i + feature_len)) 240 printf("\n"); 241 else if ((j > i) && ((j - i + 1) % 16 242 == 0)) 243 printf("\n "); 244 else if ((j - i) == 3) 245 printf("|"); 246 else 247 printf(" "); 248 } 249 } 250 } 251 if (feature == 0 && verbose > 1) { 252 if (verbose > 2) 253 printf(" Profiles:\n"); 254 for (j = i + 4; j < i + feature_len; j += 4) { 255 profile = betoh16(*(u_int16_t *)(buf+j)); 256 current = buf[j+2] == 1; 257 if (verbose < 3 && !current) 258 continue; 259 if (current) 260 printf(" * "); 261 else 262 printf(" "); 263 printf("0x%04x", profile); 264 for (k = 0; mmc_profile[k].name != NULL; k++) 265 if (profile == mmc_profile[k].id) 266 break; 267 if (mmc_profile[k].name == NULL) 268 printf(" <Undocumented>"); 269 else 270 printf(" %s", mmc_profile[k].name); 271 printf(" %s\n", current ? "[Current Profile]" : 272 "" ); 273 } 274 } 275 setbit(cap, feature); 276 } 277 278 return (0); 279 } 280 281 static int 282 set_speed(int wspeed) 283 { 284 scsireq_t scr; 285 int r; 286 287 memset(&scr, 0, sizeof(scr)); 288 scr.cmd[0] = SET_CD_SPEED; 289 scr.cmd[1] = (isset(mediacap, MMC_FEATURE_CDRW_CAV)) != 0; 290 *(u_int16_t *)(scr.cmd + 2) = htobe16(DRIVE_SPEED_OPTIMAL); 291 *(u_int16_t *)(scr.cmd + 4) = htobe16(wspeed); 292 293 scr.cmdlen = 12; 294 scr.datalen = 0; 295 scr.timeout = 120000; 296 scr.flags = SCCMD_ESCAPE; 297 scr.senselen = SENSEBUFLEN; 298 299 r = ioctl(fd, SCIOCCOMMAND, &scr); 300 return (r == 0 ? scr.retsts : -1); 301 } 302 303 int 304 blank(void) 305 { 306 struct scsi_blank *scb; 307 scsireq_t scr; 308 int r; 309 310 bzero(&scr, sizeof(scr)); 311 scb = (struct scsi_blank *)scr.cmd; 312 scb->opcode = BLANK; 313 scb->byte2 |= BLANK_MINIMAL; 314 scr.cmdlen = sizeof(*scb); 315 scr.datalen = 0; 316 scr.timeout = 120000; 317 scr.flags = SCCMD_ESCAPE; 318 scr.senselen = SENSEBUFLEN; 319 320 r = ioctl(fd, SCIOCCOMMAND, &scr); 321 return (r == 0 ? scr.retsts : -1); 322 } 323 324 int 325 unit_ready(void) 326 { 327 struct scsi_test_unit_ready *scb; 328 scsireq_t scr; 329 int r; 330 331 bzero(&scr, sizeof(scr)); 332 scb = (struct scsi_test_unit_ready *)scr.cmd; 333 scb->opcode = TEST_UNIT_READY; 334 scr.cmdlen = sizeof(*scb); 335 scr.datalen = 0; 336 scr.timeout = 120000; 337 scr.flags = SCCMD_ESCAPE; 338 scr.senselen = SENSEBUFLEN; 339 340 r = ioctl(fd, SCIOCCOMMAND, &scr); 341 return (r == 0 ? scr.retsts : -1); 342 } 343 344 int 345 synchronize_cache(void) 346 { 347 struct scsi_synchronize_cache *scb; 348 scsireq_t scr; 349 int r; 350 351 bzero(&scr, sizeof(scr)); 352 scb = (struct scsi_synchronize_cache *)scr.cmd; 353 scb->opcode = SYNCHRONIZE_CACHE; 354 scr.cmdlen = sizeof(*scb); 355 scr.datalen = 0; 356 scr.timeout = 120000; 357 scr.flags = SCCMD_ESCAPE; 358 scr.senselen = SENSEBUFLEN; 359 360 r = ioctl(fd, SCIOCCOMMAND, &scr); 361 return (r == 0 ? scr.retsts : -1); 362 } 363 364 int 365 close_session(void) 366 { 367 struct scsi_close_track *scb; 368 scsireq_t scr; 369 int r; 370 371 bzero(&scr, sizeof(scr)); 372 scb = (struct scsi_close_track *)scr.cmd; 373 scb->opcode = CLOSE_TRACK; 374 scb->closefunc = CT_CLOSE_SESS; 375 scr.cmdlen = sizeof(*scb); 376 scr.datalen = 0; 377 scr.timeout = 120000; 378 scr.flags = SCCMD_ESCAPE; 379 scr.senselen = SENSEBUFLEN; 380 381 r = ioctl(fd, SCIOCCOMMAND, &scr); 382 return (r == 0 ? scr.retsts : -1); 383 } 384 385 int 386 writetao(struct track_head *thp) 387 { 388 u_char modebuf[70], bdlen; 389 struct track_info *tr; 390 int r, track = 0; 391 392 if ((r = mode_sense_write(modebuf)) != SCCMD_OK) { 393 warnx("mode sense failed: %d", r); 394 return (r); 395 } 396 bdlen = modebuf[7]; 397 modebuf[2+8+bdlen] |= 0x40; /* Buffer Underrun Free Enable */ 398 modebuf[2+8+bdlen] |= 0x01; /* change write type to TAO */ 399 400 SLIST_FOREACH(tr, thp, track_list) { 401 track++; 402 switch (tr->type) { 403 case 'd': 404 modebuf[3+8+bdlen] = 0x04; /* track mode = data */ 405 modebuf[4+8+bdlen] = 0x08; /* 2048 block track mode */ 406 modebuf[8+8+bdlen] = 0x00; /* turn off XA */ 407 break; 408 case 'a': 409 modebuf[3+8+bdlen] = 0x00; /* track mode = audio */ 410 modebuf[4+8+bdlen] = 0x00; /* 2352 block track mode */ 411 modebuf[8+8+bdlen] = 0x00; /* turn off XA */ 412 break; 413 default: 414 warn("impossible tracktype detected"); 415 break; 416 } 417 while (unit_ready() != SCCMD_OK) 418 continue; 419 if ((r = mode_select_write(modebuf)) != SCCMD_OK) { 420 warnx("mode select failed: %d", r); 421 return (r); 422 } 423 424 set_speed(tr->speed); 425 writetrack(tr, track); 426 synchronize_cache(); 427 } 428 fprintf(stderr, "Closing session.\n"); 429 close_session(); 430 return (0); 431 } 432 433 int 434 writetrack(struct track_info *tr, int track) 435 { 436 struct timeval tv, otv, atv; 437 u_char databuf[65536], nblk; 438 u_int end_lba, lba, tmp; 439 scsireq_t scr; 440 int r; 441 442 nblk = 65535/tr->blklen; 443 bzero(&scr, sizeof(scr)); 444 scr.timeout = 300000; 445 scr.cmd[0] = WRITE_BIG; 446 scr.cmd[1] = 0x00; 447 scr.cmd[8] = nblk; /* Transfer length in blocks (LSB) */ 448 scr.cmdlen = 10; 449 scr.databuf = (caddr_t)databuf; 450 scr.datalen = nblk * tr->blklen; 451 scr.senselen = SENSEBUFLEN; 452 scr.flags = SCCMD_ESCAPE|SCCMD_WRITE; 453 454 timerclear(&otv); 455 atv.tv_sec = 1; 456 atv.tv_usec = 0; 457 458 if (get_nwa(&lba) != SCCMD_OK) { 459 warnx("cannot get next writable address"); 460 return (-1); 461 } 462 tmp = htobe32(lba); /* update lba in cdb */ 463 memcpy(&scr.cmd[2], &tmp, sizeof(tmp)); 464 465 if (tr->sz / tr->blklen + 1 > UINT_MAX || tr->sz < tr->blklen) { 466 warnx("file %s has invalid size", tr->file); 467 return (-1); 468 } 469 if (tr->sz % tr->blklen) { 470 warnx("file %s is not multiple of block length %d", 471 tr->file, tr->blklen); 472 end_lba = tr->sz / tr->blklen + lba + 1; 473 } else { 474 end_lba = tr->sz / tr->blklen + lba; 475 } 476 if (lseek(tr->fd, tr->off, SEEK_SET) == -1) 477 err(1, "seek failed for file %s", tr->file); 478 while (lba < end_lba && nblk != 0) { 479 while (lba + nblk <= end_lba) { 480 read(tr->fd, databuf, nblk * tr->blklen); 481 scr.cmd[8] = nblk; 482 scr.datalen = nblk * tr->blklen; 483 again: 484 r = ioctl(fd, SCIOCCOMMAND, &scr); 485 if (r != 0) { 486 printf("\r%60s", ""); 487 warn("ioctl failed while attempting to write"); 488 return (-1); 489 } 490 if (scr.retsts == SCCMD_SENSE && scr.sense[2] == 0x2) { 491 usleep(1000); 492 goto again; 493 } 494 if (scr.retsts != SCCMD_OK) { 495 printf("\r%60s", ""); 496 warnx("ioctl returned bad status while " 497 "attempting to write: %d", 498 scr.retsts); 499 return (r); 500 } 501 lba += nblk; 502 503 gettimeofday(&tv, NULL); 504 if (lba == end_lba || timercmp(&tv, &otv, >)) { 505 fprintf(stderr, 506 "\rtrack %02d '%c' %08u/%08u %3d%%", 507 track, tr->type, 508 lba, end_lba, 100 * lba / end_lba); 509 timeradd(&tv, &atv, &otv); 510 } 511 tmp = htobe32(lba); /* update lba in cdb */ 512 memcpy(&scr.cmd[2], &tmp, sizeof(tmp)); 513 } 514 nblk--; 515 } 516 printf("\n"); 517 close(tr->fd); 518 return (0); 519 } 520 521 int 522 mode_sense_write(unsigned char buf[]) 523 { 524 struct scsi_mode_sense_big *scb; 525 scsireq_t scr; 526 int r; 527 528 bzero(&scr, sizeof(scr)); 529 scb = (struct scsi_mode_sense_big *)scr.cmd; 530 scb->opcode = MODE_SENSE_BIG; 531 /* XXX: need to set disable block descriptors and check SCSI drive */ 532 scb->page = WRITE_PARAM_PAGE; 533 scb->length[1] = 0x46; /* 16 for the header + size from pg. 89 mmc-r10a.pdf */ 534 scr.cmdlen = sizeof(*scb); 535 scr.timeout = 4000; 536 scr.senselen = SENSEBUFLEN; 537 scr.datalen= 0x46; 538 scr.flags = SCCMD_ESCAPE|SCCMD_READ; 539 scr.databuf = (caddr_t)buf; 540 541 r = ioctl(fd, SCIOCCOMMAND, &scr); 542 return (r == 0 ? scr.retsts : -1); 543 } 544 545 int 546 mode_select_write(unsigned char buf[]) 547 { 548 struct scsi_mode_select_big *scb; 549 scsireq_t scr; 550 int r; 551 552 bzero(&scr, sizeof(scr)); 553 scb = (struct scsi_mode_select_big *)scr.cmd; 554 scb->opcode = MODE_SELECT_BIG; 555 556 /* 557 * INF-8020 says bit 4 in byte 2 is '1' 558 * INF-8090 refers to it as 'PF(1)' then doesn't 559 * describe it. 560 */ 561 scb->byte2 = 0x10; 562 scb->length[1] = 2 + buf[1] + 256 * buf[0]; 563 scr.timeout = 4000; 564 scr.senselen = SENSEBUFLEN; 565 scr.cmdlen = sizeof(*scb); 566 scr.datalen = 2 + buf[1] + 256 * buf[0]; 567 scr.flags = SCCMD_ESCAPE|SCCMD_WRITE; 568 scr.databuf = (caddr_t)buf; 569 570 r = ioctl(fd, SCIOCCOMMAND, &scr); 571 return (r == 0 ? scr.retsts : -1); 572 } 573 574 int 575 get_disc_size(off_t *availblk) 576 { 577 u_char databuf[28]; 578 struct scsi_read_track_info *scb; 579 scsireq_t scr; 580 int r, tmp; 581 582 bzero(&scr, sizeof(scr)); 583 scb = (struct scsi_read_track_info *)scr.cmd; 584 scr.timeout = 4000; 585 scr.senselen = SENSEBUFLEN; 586 scb->opcode = READ_TRACK_INFO; 587 scb->addrtype = RTI_TRACK; 588 scb->addr[3] = 1; 589 scb->data_len[1] = 0x1c; 590 scr.cmdlen = sizeof(*scb); 591 scr.datalen= 0x1c; 592 scr.flags = SCCMD_ESCAPE|SCCMD_READ; 593 scr.databuf = (caddr_t)databuf; 594 595 r = ioctl(fd, SCIOCCOMMAND, &scr); 596 memcpy(&tmp, &databuf[16], sizeof(tmp)); 597 *availblk = betoh32(tmp); 598 return (r == 0 ? scr.retsts : -1); 599 } 600 601 int 602 get_nwa(int *nwa) 603 { 604 u_char databuf[28]; 605 scsireq_t scr; 606 int r, tmp; 607 608 bzero(&scr, sizeof(scr)); 609 scr.timeout = 4000; 610 scr.senselen = SENSEBUFLEN; 611 scr.cmd[0] = READ_TRACK_INFO; 612 scr.cmd[1] = 0x01; 613 scr.cmd[5] = 0xff; /* Invisible Track */ 614 scr.cmd[7] = 0x00; 615 scr.cmd[8] = 0x1c; 616 scr.cmdlen = 10; 617 scr.datalen= 0x1c; 618 scr.flags = SCCMD_ESCAPE|SCCMD_READ; 619 scr.databuf = (caddr_t)databuf; 620 621 r = ioctl(fd, SCIOCCOMMAND, &scr); 622 memcpy(&tmp, &databuf[12], sizeof(tmp)); 623 *nwa = betoh32(tmp); 624 return (r == 0 ? scr.retsts : -1); 625 } 626