1 /*- 2 * SPDX-License-Identifier: BSD-2-Clause-FreeBSD 3 * 4 * Copyright (c) 2011 Sandvine Incorporated. All rights reserved. 5 * Copyright (c) 2002-2011 Andre Albsmeier <andre@albsmeier.net> 6 * All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer, 13 * without modification, immediately at the beginning of the file. 14 * 2. Redistributions in binary form must reproduce the above copyright 15 * notice, this list of conditions and the following disclaimer in the 16 * documentation and/or other materials provided with the distribution. 17 * 18 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 19 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 20 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 21 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 22 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 23 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 24 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 25 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 26 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 27 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 28 */ 29 30 /* 31 * This software is derived from Andre Albsmeier's fwprog.c which contained 32 * the following note: 33 * 34 * Many thanks goes to Marc Frajola <marc@terasolutions.com> from 35 * TeraSolutions for the initial idea and his programme for upgrading 36 * the firmware of I*M DDYS drives. 37 */ 38 39 /* 40 * BEWARE: 41 * 42 * The fact that you see your favorite vendor listed below does not 43 * imply that your equipment won't break when you use this software 44 * with it. It only means that the firmware of at least one device type 45 * of each vendor listed has been programmed successfully using this code. 46 * 47 * The -s option simulates a download but does nothing apart from that. 48 * It can be used to check what chunk sizes would have been used with the 49 * specified device. 50 */ 51 52 #include <sys/cdefs.h> 53 __FBSDID("$FreeBSD$"); 54 55 #include <sys/types.h> 56 #include <sys/stat.h> 57 58 #include <err.h> 59 #include <fcntl.h> 60 #include <stdio.h> 61 #include <stdlib.h> 62 #include <string.h> 63 #include <unistd.h> 64 65 #include <cam/scsi/scsi_all.h> 66 #include <cam/scsi/scsi_message.h> 67 #include <camlib.h> 68 69 #include "progress.h" 70 71 #include "camcontrol.h" 72 73 #define WB_TIMEOUT 50000 /* 50 seconds */ 74 75 typedef enum { 76 VENDOR_HGST, 77 VENDOR_HITACHI, 78 VENDOR_HP, 79 VENDOR_IBM, 80 VENDOR_PLEXTOR, 81 VENDOR_QUALSTAR, 82 VENDOR_QUANTUM, 83 VENDOR_SAMSUNG, 84 VENDOR_SEAGATE, 85 VENDOR_SMART, 86 VENDOR_ATA, 87 VENDOR_UNKNOWN 88 } fw_vendor_t; 89 90 /* 91 * FW_TUR_READY: The drive must return good status for a test unit ready. 92 * 93 * FW_TUR_NOT_READY: The drive must return not ready status for a test unit 94 * ready. You may want this in a removable media drive. 95 * 96 * FW_TUR_NA: It doesn't matter whether the drive is ready or not. 97 * This may be the case for a removable media drive. 98 */ 99 typedef enum { 100 FW_TUR_NONE, 101 FW_TUR_READY, 102 FW_TUR_NOT_READY, 103 FW_TUR_NA 104 } fw_tur_status; 105 106 /* 107 * FW_TIMEOUT_DEFAULT: Attempt to probe for a WRITE BUFFER timeout 108 * value from the drive. If we get an answer, 109 * use the Recommended timeout. Otherwise, 110 * use the default value from the table. 111 * 112 * FW_TIMEOUT_DEV_REPORTED: The timeout value was probed directly from 113 * the device. 114 * 115 * FW_TIMEOUT_NO_PROBE: Do not ask the device for a WRITE BUFFER 116 * timeout value. Use the device-specific 117 * value. 118 * 119 * FW_TIMEOUT_USER_SPEC: The user specified a timeout on the command 120 * line with the -t option. This overrides any 121 * probe or default timeout. 122 */ 123 typedef enum { 124 FW_TIMEOUT_DEFAULT, 125 FW_TIMEOUT_DEV_REPORTED, 126 FW_TIMEOUT_NO_PROBE, 127 FW_TIMEOUT_USER_SPEC 128 } fw_timeout_type; 129 130 /* 131 * type: Enumeration for the particular vendor. 132 * 133 * pattern: Pattern to match for the Vendor ID from the SCSI 134 * Inquiry data. 135 * 136 * dev_type: SCSI device type to match, or T_ANY to match any 137 * device from the given vendor. Note that if there 138 * is a specific device type listed for a particular 139 * vendor, it must be listed before a T_ANY entry. 140 * 141 * max_pkt_size: Maximum packet size when talking to a device. Note 142 * that although large data sizes may be supported by 143 * the target device, they may not be supported by the 144 * OS or the controller. 145 * 146 * cdb_byte2: This specifies byte 2 (byte 1 when counting from 0) 147 * of the CDB. This is generally the WRITE BUFFER mode. 148 * 149 * cdb_byte2_last: This specifies byte 2 for the last chunk of the 150 * download. 151 * 152 * inc_cdb_buffer_id: Increment the buffer ID by 1 for each chunk sent 153 * down to the drive. 154 * 155 * inc_cdb_offset: Increment the offset field in the CDB with the byte 156 * offset into the firmware file. 157 * 158 * tur_status: Pay attention to whether the device is ready before 159 * upgrading the firmware, or not. See above for the 160 * values. 161 */ 162 struct fw_vendor { 163 fw_vendor_t type; 164 const char *pattern; 165 int dev_type; 166 int max_pkt_size; 167 u_int8_t cdb_byte2; 168 u_int8_t cdb_byte2_last; 169 int inc_cdb_buffer_id; 170 int inc_cdb_offset; 171 fw_tur_status tur_status; 172 int timeout_ms; 173 fw_timeout_type timeout_type; 174 }; 175 176 /* 177 * Vendor notes: 178 * 179 * HGST: The packets need to be sent in multiples of 4K. 180 * 181 * IBM: For LTO and TS drives, the buffer ID is ignored in mode 7 (and 182 * some other modes). It treats the request as a firmware download. 183 * The offset (and therefore the length of each chunk sent) needs 184 * to be a multiple of the offset boundary specified for firmware 185 * (buffer ID 4) in the read buffer command. At least for LTO-6, 186 * that seems to be 0, but using a 32K chunk size should satisfy 187 * most any alignment requirement. 188 * 189 * SmrtStor: Mode 5 is also supported, but since the firmware is 400KB or 190 * so, we can't fit it in a single request in most cases. 191 */ 192 static struct fw_vendor vendors_list[] = { 193 {VENDOR_HGST, "HGST", T_DIRECT, 194 0x1000, 0x07, 0x07, 1, 0, FW_TUR_READY, WB_TIMEOUT, FW_TIMEOUT_DEFAULT}, 195 {VENDOR_HITACHI, "HITACHI", T_ANY, 196 0x8000, 0x05, 0x05, 1, 0, FW_TUR_READY, WB_TIMEOUT, FW_TIMEOUT_DEFAULT}, 197 {VENDOR_HP, "HP", T_ANY, 198 0x8000, 0x07, 0x07, 0, 1, FW_TUR_READY, WB_TIMEOUT, FW_TIMEOUT_DEFAULT}, 199 {VENDOR_IBM, "IBM", T_SEQUENTIAL, 200 0x8000, 0x07, 0x07, 0, 1, FW_TUR_NA, 300 * 1000, FW_TIMEOUT_DEFAULT}, 201 {VENDOR_IBM, "IBM", T_ANY, 202 0x8000, 0x05, 0x05, 1, 0, FW_TUR_READY, WB_TIMEOUT, FW_TIMEOUT_DEFAULT}, 203 {VENDOR_PLEXTOR, "PLEXTOR", T_ANY, 204 0x2000, 0x04, 0x05, 0, 1, FW_TUR_READY, WB_TIMEOUT, FW_TIMEOUT_DEFAULT}, 205 {VENDOR_QUALSTAR, "QUALSTAR", T_ANY, 206 0x2030, 0x05, 0x05, 0, 0, FW_TUR_READY, WB_TIMEOUT, FW_TIMEOUT_DEFAULT}, 207 {VENDOR_QUANTUM, "QUANTUM", T_ANY, 208 0x2000, 0x04, 0x05, 0, 1, FW_TUR_READY, WB_TIMEOUT, FW_TIMEOUT_DEFAULT}, 209 {VENDOR_SAMSUNG, "SAMSUNG", T_ANY, 210 0x8000, 0x07, 0x07, 0, 1, FW_TUR_READY, WB_TIMEOUT, FW_TIMEOUT_DEFAULT}, 211 {VENDOR_SEAGATE, "SEAGATE", T_ANY, 212 0x8000, 0x07, 0x07, 0, 1, FW_TUR_READY, WB_TIMEOUT, FW_TIMEOUT_DEFAULT}, 213 {VENDOR_SMART, "SmrtStor", T_DIRECT, 214 0x8000, 0x07, 0x07, 0, 1, FW_TUR_READY, WB_TIMEOUT, FW_TIMEOUT_DEFAULT}, 215 {VENDOR_HGST, "WD", T_DIRECT, 216 0x1000, 0x07, 0x07, 1, 0, FW_TUR_READY, WB_TIMEOUT, FW_TIMEOUT_DEFAULT}, 217 {VENDOR_HGST, "WDC", T_DIRECT, 218 0x1000, 0x07, 0x07, 1, 0, FW_TUR_READY, WB_TIMEOUT, FW_TIMEOUT_DEFAULT}, 219 220 /* 221 * We match any ATA device. This is really just a placeholder, 222 * since we won't actually send a WRITE BUFFER with any of the 223 * listed parameters. If a SATA device is behind a SAS controller, 224 * the SCSI to ATA translation code (at least for LSI) doesn't 225 * generally translate a SCSI WRITE BUFFER into an ATA DOWNLOAD 226 * MICROCODE command. So, we use the SCSI ATA PASS_THROUGH command 227 * to send the ATA DOWNLOAD MICROCODE command instead. 228 */ 229 {VENDOR_ATA, "ATA", T_ANY, 230 0x8000, 0x07, 0x07, 0, 1, FW_TUR_READY, WB_TIMEOUT, 231 FW_TIMEOUT_NO_PROBE}, 232 {VENDOR_UNKNOWN, NULL, T_ANY, 233 0x0000, 0x00, 0x00, 0, 0, FW_TUR_NONE, WB_TIMEOUT, FW_TIMEOUT_DEFAULT} 234 }; 235 236 struct fw_timeout_desc { 237 fw_timeout_type timeout_type; 238 const char *timeout_desc; 239 }; 240 241 static const struct fw_timeout_desc fw_timeout_desc_table[] = { 242 { FW_TIMEOUT_DEFAULT, "the default" }, 243 { FW_TIMEOUT_DEV_REPORTED, "recommended by this particular device" }, 244 { FW_TIMEOUT_NO_PROBE, "the default" }, 245 { FW_TIMEOUT_USER_SPEC, "what was specified on the command line" } 246 }; 247 248 #ifndef ATA_DOWNLOAD_MICROCODE 249 #define ATA_DOWNLOAD_MICROCODE 0x92 250 #endif 251 252 #define USE_OFFSETS_FEATURE 0x3 253 254 #ifndef LOW_SECTOR_SIZE 255 #define LOW_SECTOR_SIZE 512 256 #endif 257 258 #define ATA_MAKE_LBA(o, p) \ 259 ((((((o) / LOW_SECTOR_SIZE) >> 8) & 0xff) << 16) | \ 260 ((((o) / LOW_SECTOR_SIZE) & 0xff) << 8) | \ 261 ((((p) / LOW_SECTOR_SIZE) >> 8) & 0xff)) 262 263 #define ATA_MAKE_SECTORS(p) (((p) / 512) & 0xff) 264 265 #ifndef UNKNOWN_MAX_PKT_SIZE 266 #define UNKNOWN_MAX_PKT_SIZE 0x8000 267 #endif 268 269 static struct fw_vendor *fw_get_vendor(struct cam_device *cam_dev, 270 struct ata_params *ident_buf); 271 static int fw_get_timeout(struct cam_device *cam_dev, struct fw_vendor *vp, 272 int task_attr, int retry_count, int timeout); 273 static int fw_validate_ibm(struct cam_device *dev, int retry_count, 274 int timeout, int fd, char *buf, 275 const char *fw_img_path, int quiet); 276 static char *fw_read_img(struct cam_device *dev, int retry_count, 277 int timeout, int quiet, const char *fw_img_path, 278 struct fw_vendor *vp, int *num_bytes); 279 static int fw_check_device_ready(struct cam_device *dev, 280 camcontrol_devtype devtype, 281 struct fw_vendor *vp, int printerrors, 282 int timeout); 283 static int fw_download_img(struct cam_device *cam_dev, 284 struct fw_vendor *vp, char *buf, int img_size, 285 int sim_mode, int printerrors, int quiet, 286 int retry_count, int timeout, const char */*name*/, 287 camcontrol_devtype devtype); 288 289 /* 290 * Find entry in vendors list that belongs to 291 * the vendor of given cam device. 292 */ 293 static struct fw_vendor * 294 fw_get_vendor(struct cam_device *cam_dev, struct ata_params *ident_buf) 295 { 296 char vendor[42]; 297 struct fw_vendor *vp; 298 299 if (cam_dev == NULL) 300 return (NULL); 301 302 if (ident_buf != NULL) { 303 cam_strvis((u_char *)vendor, ident_buf->model, 304 sizeof(ident_buf->model), sizeof(vendor)); 305 for (vp = vendors_list; vp->pattern != NULL; vp++) { 306 if (vp->type == VENDOR_ATA) 307 return (vp); 308 } 309 } else { 310 cam_strvis((u_char *)vendor, (u_char *)cam_dev->inq_data.vendor, 311 sizeof(cam_dev->inq_data.vendor), sizeof(vendor)); 312 } 313 for (vp = vendors_list; vp->pattern != NULL; vp++) { 314 if (!cam_strmatch((const u_char *)vendor, 315 (const u_char *)vp->pattern, strlen(vendor))) { 316 if ((vp->dev_type == T_ANY) 317 || (vp->dev_type == SID_TYPE(&cam_dev->inq_data))) 318 break; 319 } 320 } 321 return (vp); 322 } 323 324 static int 325 fw_get_timeout(struct cam_device *cam_dev, struct fw_vendor *vp, 326 int task_attr, int retry_count, int timeout) 327 { 328 struct scsi_report_supported_opcodes_one *one; 329 struct scsi_report_supported_opcodes_timeout *td; 330 uint8_t *buf = NULL; 331 uint32_t fill_len = 0, cdb_len = 0, rec_timeout = 0; 332 int retval = 0; 333 334 /* 335 * If the user has specified a timeout on the command line, we let 336 * him override any default or probed value. 337 */ 338 if (timeout != 0) { 339 vp->timeout_type = FW_TIMEOUT_USER_SPEC; 340 vp->timeout_ms = timeout; 341 goto bailout; 342 } 343 344 /* 345 * Check to see whether we should probe for a timeout for this 346 * device. 347 */ 348 if (vp->timeout_type == FW_TIMEOUT_NO_PROBE) 349 goto bailout; 350 351 retval = scsigetopcodes(/*device*/ cam_dev, 352 /*opcode_set*/ 1, 353 /*opcode*/ WRITE_BUFFER, 354 /*show_sa_errors*/ 1, 355 /*sa_set*/ 0, 356 /*service_action*/ 0, 357 /*timeout_desc*/ 1, 358 /*task_attr*/ task_attr, 359 /*retry_count*/ retry_count, 360 /*timeout*/ 10000, 361 /*verbose*/ 0, 362 /*fill_len*/ &fill_len, 363 /*data_ptr*/ &buf); 364 /* 365 * It isn't an error if we can't get a timeout descriptor. We just 366 * continue on with the default timeout. 367 */ 368 if (retval != 0) { 369 retval = 0; 370 goto bailout; 371 } 372 373 /* 374 * Even if the drive didn't return a SCSI error, if we don't have 375 * enough data to contain the one opcode descriptor, the CDB 376 * structure and a timeout descriptor, we don't have the timeout 377 * value we're looking for. So we'll just fall back to the 378 * default value. 379 */ 380 if (fill_len < (sizeof(*one) + sizeof(struct scsi_write_buffer) + 381 sizeof(*td))) 382 goto bailout; 383 384 one = (struct scsi_report_supported_opcodes_one *)buf; 385 386 /* 387 * If the drive claims to not support the WRITE BUFFER command... 388 * fall back to the default timeout value and let things fail on 389 * the actual firmware download. 390 */ 391 if ((one->support & RSO_ONE_SUP_MASK) == RSO_ONE_SUP_NOT_SUP) 392 goto bailout; 393 394 cdb_len = scsi_2btoul(one->cdb_length); 395 td = (struct scsi_report_supported_opcodes_timeout *) 396 &buf[sizeof(*one) + cdb_len]; 397 398 rec_timeout = scsi_4btoul(td->recommended_time); 399 /* 400 * If the recommended timeout is 0, then the device has probably 401 * returned a bogus value. 402 */ 403 if (rec_timeout == 0) 404 goto bailout; 405 406 /* CAM timeouts are in ms */ 407 rec_timeout *= 1000; 408 409 vp->timeout_ms = rec_timeout; 410 vp->timeout_type = FW_TIMEOUT_DEV_REPORTED; 411 412 bailout: 413 return (retval); 414 } 415 416 #define SVPD_IBM_FW_DESIGNATION 0x03 417 418 /* 419 * IBM LTO and TS tape drives have an INQUIRY VPD page 0x3 with the following 420 * format: 421 */ 422 struct fw_ibm_tape_fw_designation { 423 uint8_t device; 424 uint8_t page_code; 425 uint8_t reserved; 426 uint8_t length; 427 uint8_t ascii_length; 428 uint8_t reserved2[3]; 429 uint8_t load_id[4]; 430 uint8_t fw_rev[4]; 431 uint8_t ptf_number[4]; 432 uint8_t patch_number[4]; 433 uint8_t ru_name[8]; 434 uint8_t lib_seq_num[5]; 435 }; 436 437 /* 438 * The firmware for IBM tape drives has the following header format. The 439 * load_id and ru_name in the header file should match what is returned in 440 * VPD page 0x3. 441 */ 442 struct fw_ibm_tape_fw_header { 443 uint8_t unspec[4]; 444 uint8_t length[4]; /* Firmware and header! */ 445 uint8_t load_id[4]; 446 uint8_t fw_rev[4]; 447 uint8_t reserved[8]; 448 uint8_t ru_name[8]; 449 }; 450 451 static int 452 fw_validate_ibm(struct cam_device *dev, int retry_count, int timeout, int fd, 453 char *buf, const char *fw_img_path, int quiet) 454 { 455 union ccb *ccb; 456 struct fw_ibm_tape_fw_designation vpd_page; 457 struct fw_ibm_tape_fw_header *header; 458 char drive_rev[sizeof(vpd_page.fw_rev) + 1]; 459 char file_rev[sizeof(vpd_page.fw_rev) + 1]; 460 int retval = 1; 461 462 ccb = cam_getccb(dev); 463 if (ccb == NULL) { 464 warnx("couldn't allocate CCB"); 465 goto bailout; 466 } 467 468 /* cam_getccb cleans up the header, caller has to zero the payload */ 469 CCB_CLEAR_ALL_EXCEPT_HDR(&ccb->csio); 470 471 bzero(&vpd_page, sizeof(vpd_page)); 472 473 scsi_inquiry(&ccb->csio, 474 /*retries*/ retry_count, 475 /*cbfcnp*/ NULL, 476 /* tag_action */ MSG_SIMPLE_Q_TAG, 477 /* inq_buf */ (u_int8_t *)&vpd_page, 478 /* inq_len */ sizeof(vpd_page), 479 /* evpd */ 1, 480 /* page_code */ SVPD_IBM_FW_DESIGNATION, 481 /* sense_len */ SSD_FULL_SIZE, 482 /* timeout */ timeout ? timeout : 5000); 483 484 /* Disable freezing the device queue */ 485 ccb->ccb_h.flags |= CAM_DEV_QFRZDIS; 486 487 if (retry_count != 0) 488 ccb->ccb_h.flags |= CAM_PASS_ERR_RECOVER; 489 490 if (cam_send_ccb(dev, ccb) < 0) { 491 warn("error getting firmware designation page"); 492 493 cam_error_print(dev, ccb, CAM_ESF_ALL, 494 CAM_EPF_ALL, stderr); 495 496 cam_freeccb(ccb); 497 ccb = NULL; 498 goto bailout; 499 } 500 501 if ((ccb->ccb_h.status & CAM_STATUS_MASK) != CAM_REQ_CMP) { 502 cam_error_print(dev, ccb, CAM_ESF_ALL, 503 CAM_EPF_ALL, stderr); 504 goto bailout; 505 } 506 507 /* 508 * Read the firmware header only. 509 */ 510 if (read(fd, buf, sizeof(*header)) != sizeof(*header)) { 511 warn("unable to read %zu bytes from %s", sizeof(*header), 512 fw_img_path); 513 goto bailout; 514 } 515 516 /* Rewind the file back to 0 for the full file read. */ 517 if (lseek(fd, 0, SEEK_SET) == -1) { 518 warn("Unable to lseek"); 519 goto bailout; 520 } 521 522 header = (struct fw_ibm_tape_fw_header *)buf; 523 524 bzero(drive_rev, sizeof(drive_rev)); 525 bcopy(vpd_page.fw_rev, drive_rev, sizeof(vpd_page.fw_rev)); 526 bzero(file_rev, sizeof(file_rev)); 527 bcopy(header->fw_rev, file_rev, sizeof(header->fw_rev)); 528 529 if (quiet == 0) { 530 fprintf(stdout, "Current Drive Firmware version: %s\n", 531 drive_rev); 532 fprintf(stdout, "Firmware File version: %s\n", file_rev); 533 } 534 535 /* 536 * For IBM tape drives the load ID and RU name reported by the 537 * drive should match what is in the firmware file. 538 */ 539 if (bcmp(vpd_page.load_id, header->load_id, 540 MIN(sizeof(vpd_page.load_id), sizeof(header->load_id))) != 0) { 541 warnx("Drive Firmware load ID 0x%x does not match firmware " 542 "file load ID 0x%x", scsi_4btoul(vpd_page.load_id), 543 scsi_4btoul(header->load_id)); 544 goto bailout; 545 } 546 547 if (bcmp(vpd_page.ru_name, header->ru_name, 548 MIN(sizeof(vpd_page.ru_name), sizeof(header->ru_name))) != 0) { 549 warnx("Drive Firmware RU name 0x%jx does not match firmware " 550 "file RU name 0x%jx", 551 (uintmax_t)scsi_8btou64(vpd_page.ru_name), 552 (uintmax_t)scsi_8btou64(header->ru_name)); 553 goto bailout; 554 } 555 if (quiet == 0) 556 fprintf(stdout, "Firmware file is valid for this drive.\n"); 557 retval = 0; 558 bailout: 559 cam_freeccb(ccb); 560 561 return (retval); 562 } 563 564 /* 565 * Allocate a buffer and read fw image file into it 566 * from given path. Number of bytes read is stored 567 * in num_bytes. 568 */ 569 static char * 570 fw_read_img(struct cam_device *dev, int retry_count, int timeout, int quiet, 571 const char *fw_img_path, struct fw_vendor *vp, int *num_bytes) 572 { 573 int fd; 574 struct stat stbuf; 575 char *buf; 576 off_t img_size; 577 int skip_bytes = 0; 578 579 if ((fd = open(fw_img_path, O_RDONLY)) < 0) { 580 warn("Could not open image file %s", fw_img_path); 581 return (NULL); 582 } 583 if (fstat(fd, &stbuf) < 0) { 584 warn("Could not stat image file %s", fw_img_path); 585 goto bailout1; 586 } 587 if ((img_size = stbuf.st_size) == 0) { 588 warnx("Zero length image file %s", fw_img_path); 589 goto bailout1; 590 } 591 if ((buf = malloc(img_size)) == NULL) { 592 warnx("Could not allocate buffer to read image file %s", 593 fw_img_path); 594 goto bailout1; 595 } 596 /* Skip headers if applicable. */ 597 switch (vp->type) { 598 case VENDOR_SEAGATE: 599 if (read(fd, buf, 16) != 16) { 600 warn("Could not read image file %s", fw_img_path); 601 goto bailout; 602 } 603 if (lseek(fd, 0, SEEK_SET) == -1) { 604 warn("Unable to lseek"); 605 goto bailout; 606 } 607 if ((strncmp(buf, "SEAGATE,SEAGATE ", 16) == 0) || 608 (img_size % 512 == 80)) 609 skip_bytes = 80; 610 break; 611 case VENDOR_QUALSTAR: 612 skip_bytes = img_size % 1030; 613 break; 614 case VENDOR_IBM: { 615 if (vp->dev_type != T_SEQUENTIAL) 616 break; 617 if (fw_validate_ibm(dev, retry_count, timeout, fd, buf, 618 fw_img_path, quiet) != 0) 619 goto bailout; 620 break; 621 } 622 default: 623 break; 624 } 625 if (skip_bytes != 0) { 626 fprintf(stdout, "Skipping %d byte header.\n", skip_bytes); 627 if (lseek(fd, skip_bytes, SEEK_SET) == -1) { 628 warn("Could not lseek"); 629 goto bailout; 630 } 631 img_size -= skip_bytes; 632 } 633 /* Read image into a buffer. */ 634 if (read(fd, buf, img_size) != img_size) { 635 warn("Could not read image file %s", fw_img_path); 636 goto bailout; 637 } 638 *num_bytes = img_size; 639 close(fd); 640 return (buf); 641 bailout: 642 free(buf); 643 bailout1: 644 close(fd); 645 *num_bytes = 0; 646 return (NULL); 647 } 648 649 /* 650 * Returns 0 for "success", where success means that the device has met the 651 * requirement in the vendor structure for being ready or not ready when 652 * firmware is downloaded. 653 * 654 * Returns 1 for a failure to be ready to accept a firmware download. 655 * (e.g., a drive needs to be ready, but returns not ready) 656 * 657 * Returns -1 for any other failure. 658 */ 659 static int 660 fw_check_device_ready(struct cam_device *dev, camcontrol_devtype devtype, 661 struct fw_vendor *vp, int printerrors, int timeout) 662 { 663 union ccb *ccb; 664 int retval = 0; 665 int16_t *ptr = NULL; 666 size_t dxfer_len = 0; 667 668 if ((ccb = cam_getccb(dev)) == NULL) { 669 warnx("Could not allocate CCB"); 670 retval = -1; 671 goto bailout; 672 } 673 674 CCB_CLEAR_ALL_EXCEPT_HDR(ccb); 675 676 if (devtype != CC_DT_SCSI) { 677 dxfer_len = sizeof(struct ata_params); 678 679 ptr = (uint16_t *)malloc(dxfer_len); 680 if (ptr == NULL) { 681 warnx("can't malloc memory for identify"); 682 retval = -1; 683 goto bailout; 684 } 685 bzero(ptr, dxfer_len); 686 } 687 688 switch (devtype) { 689 case CC_DT_SCSI: 690 scsi_test_unit_ready(&ccb->csio, 691 /*retries*/ 0, 692 /*cbfcnp*/ NULL, 693 /*tag_action*/ MSG_SIMPLE_Q_TAG, 694 /*sense_len*/ SSD_FULL_SIZE, 695 /*timeout*/ 5000); 696 break; 697 case CC_DT_SATL: 698 case CC_DT_ATA: { 699 retval = build_ata_cmd(ccb, 700 /*retries*/ 1, 701 /*flags*/ CAM_DIR_IN, 702 /*tag_action*/ MSG_SIMPLE_Q_TAG, 703 /*protocol*/ AP_PROTO_PIO_IN, 704 /*ata_flags*/ AP_FLAG_BYT_BLOK_BLOCKS | 705 AP_FLAG_TLEN_SECT_CNT | 706 AP_FLAG_TDIR_FROM_DEV, 707 /*features*/ 0, 708 /*sector_count*/ dxfer_len / 512, 709 /*lba*/ 0, 710 /*command*/ ATA_ATA_IDENTIFY, 711 /*auxiliary*/ 0, 712 /*data_ptr*/ (uint8_t *)ptr, 713 /*dxfer_len*/ dxfer_len, 714 /*cdb_storage*/ NULL, 715 /*cdb_storage_len*/ 0, 716 /*sense_len*/ SSD_FULL_SIZE, 717 /*timeout*/ timeout ? timeout : 30 * 1000, 718 /*is48bit*/ 0, 719 /*devtype*/ devtype); 720 if (retval != 0) { 721 retval = -1; 722 warnx("%s: build_ata_cmd() failed, likely " 723 "programmer error", __func__); 724 goto bailout; 725 } 726 break; 727 } 728 default: 729 warnx("Unknown disk type %d", devtype); 730 retval = -1; 731 goto bailout; 732 break; /*NOTREACHED*/ 733 } 734 735 ccb->ccb_h.flags |= CAM_DEV_QFRZDIS; 736 737 retval = cam_send_ccb(dev, ccb); 738 if (retval != 0) { 739 warn("error sending %s CCB", (devtype == CC_DT_SCSI) ? 740 "Test Unit Ready" : "Identify"); 741 retval = -1; 742 goto bailout; 743 } 744 745 if (((ccb->ccb_h.status & CAM_STATUS_MASK) != CAM_REQ_CMP) 746 && (vp->tur_status == FW_TUR_READY)) { 747 warnx("Device is not ready"); 748 if (printerrors) 749 cam_error_print(dev, ccb, CAM_ESF_ALL, 750 CAM_EPF_ALL, stderr); 751 retval = 1; 752 goto bailout; 753 } else if (((ccb->ccb_h.status & CAM_STATUS_MASK) == CAM_REQ_CMP) 754 && (vp->tur_status == FW_TUR_NOT_READY)) { 755 warnx("Device cannot have media loaded when firmware is " 756 "downloaded"); 757 retval = 1; 758 goto bailout; 759 } 760 bailout: 761 free(ptr); 762 cam_freeccb(ccb); 763 764 return (retval); 765 } 766 767 /* 768 * Download firmware stored in buf to cam_dev. If simulation mode 769 * is enabled, only show what packet sizes would be sent to the 770 * device but do not sent any actual packets 771 */ 772 static int 773 fw_download_img(struct cam_device *cam_dev, struct fw_vendor *vp, 774 char *buf, int img_size, int sim_mode, int printerrors, int quiet, 775 int retry_count, int timeout, const char *imgname, 776 camcontrol_devtype devtype) 777 { 778 struct scsi_write_buffer cdb; 779 progress_t progress; 780 int size = 0; 781 union ccb *ccb = NULL; 782 int pkt_count = 0; 783 int max_pkt_size; 784 u_int32_t pkt_size = 0; 785 char *pkt_ptr = buf; 786 u_int32_t offset; 787 int last_pkt = 0; 788 int retval = 0; 789 790 /* 791 * Check to see whether the device is ready to accept a firmware 792 * download. 793 */ 794 retval = fw_check_device_ready(cam_dev, devtype, vp, printerrors, 795 timeout); 796 if (retval != 0) 797 goto bailout; 798 799 if ((ccb = cam_getccb(cam_dev)) == NULL) { 800 warnx("Could not allocate CCB"); 801 retval = 1; 802 goto bailout; 803 } 804 805 CCB_CLEAR_ALL_EXCEPT_HDR(ccb); 806 807 max_pkt_size = vp->max_pkt_size; 808 if (max_pkt_size == 0) 809 max_pkt_size = UNKNOWN_MAX_PKT_SIZE; 810 811 pkt_size = max_pkt_size; 812 progress_init(&progress, imgname, size = img_size); 813 /* Download single fw packets. */ 814 do { 815 if (img_size <= max_pkt_size) { 816 last_pkt = 1; 817 pkt_size = img_size; 818 } 819 progress_update(&progress, size - img_size); 820 if (((sim_mode == 0) && (quiet == 0)) 821 || ((sim_mode != 0) && (printerrors == 0))) 822 progress_draw(&progress); 823 bzero(&cdb, sizeof(cdb)); 824 switch (devtype) { 825 case CC_DT_SCSI: 826 cdb.opcode = WRITE_BUFFER; 827 cdb.control = 0; 828 /* Parameter list length. */ 829 scsi_ulto3b(pkt_size, &cdb.length[0]); 830 offset = vp->inc_cdb_offset ? (pkt_ptr - buf) : 0; 831 scsi_ulto3b(offset, &cdb.offset[0]); 832 cdb.byte2 = last_pkt ? vp->cdb_byte2_last : 833 vp->cdb_byte2; 834 cdb.buffer_id = vp->inc_cdb_buffer_id ? pkt_count : 0; 835 /* Zero out payload of ccb union after ccb header. */ 836 CCB_CLEAR_ALL_EXCEPT_HDR(&ccb->csio); 837 /* 838 * Copy previously constructed cdb into ccb_scsiio 839 * struct. 840 */ 841 bcopy(&cdb, &ccb->csio.cdb_io.cdb_bytes[0], 842 sizeof(struct scsi_write_buffer)); 843 /* Fill rest of ccb_scsiio struct. */ 844 cam_fill_csio(&ccb->csio, /* ccb_scsiio*/ 845 retry_count, /* retries*/ 846 NULL, /* cbfcnp*/ 847 CAM_DIR_OUT | CAM_DEV_QFRZDIS, /* flags*/ 848 CAM_TAG_ACTION_NONE, /* tag_action*/ 849 (u_char *)pkt_ptr, /* data_ptr*/ 850 pkt_size, /* dxfer_len*/ 851 SSD_FULL_SIZE, /* sense_len*/ 852 sizeof(struct scsi_write_buffer), /* cdb_len*/ 853 timeout ? timeout : WB_TIMEOUT); /* timeout*/ 854 break; 855 case CC_DT_ATA: 856 case CC_DT_SATL: { 857 uint32_t off; 858 859 off = (uint32_t)(pkt_ptr - buf); 860 861 retval = build_ata_cmd(ccb, 862 /*retry_count*/ retry_count, 863 /*flags*/ CAM_DIR_OUT | CAM_DEV_QFRZDIS, 864 /*tag_action*/ CAM_TAG_ACTION_NONE, 865 /*protocol*/ AP_PROTO_PIO_OUT, 866 /*ata_flags*/ AP_FLAG_BYT_BLOK_BYTES | 867 AP_FLAG_TLEN_SECT_CNT | 868 AP_FLAG_TDIR_TO_DEV, 869 /*features*/ USE_OFFSETS_FEATURE, 870 /*sector_count*/ ATA_MAKE_SECTORS(pkt_size), 871 /*lba*/ ATA_MAKE_LBA(off, pkt_size), 872 /*command*/ ATA_DOWNLOAD_MICROCODE, 873 /*auxiliary*/ 0, 874 /*data_ptr*/ (uint8_t *)pkt_ptr, 875 /*dxfer_len*/ pkt_size, 876 /*cdb_storage*/ NULL, 877 /*cdb_storage_len*/ 0, 878 /*sense_len*/ SSD_FULL_SIZE, 879 /*timeout*/ timeout ? timeout : WB_TIMEOUT, 880 /*is48bit*/ 0, 881 /*devtype*/ devtype); 882 883 if (retval != 0) { 884 warnx("%s: build_ata_cmd() failed, likely " 885 "programmer error", __func__); 886 goto bailout; 887 } 888 break; 889 } 890 default: 891 warnx("Unknown device type %d", devtype); 892 retval = 1; 893 goto bailout; 894 break; /*NOTREACHED*/ 895 } 896 if (!sim_mode) { 897 /* Execute the command. */ 898 if (cam_send_ccb(cam_dev, ccb) < 0 || 899 (ccb->ccb_h.status & CAM_STATUS_MASK) != 900 CAM_REQ_CMP) { 901 warnx("Error writing image to device"); 902 if (printerrors) 903 cam_error_print(cam_dev, ccb, 904 CAM_ESF_ALL, CAM_EPF_ALL, stderr); 905 retval = 1; 906 goto bailout; 907 } 908 } else if (printerrors) { 909 cam_error_print(cam_dev, ccb, CAM_ESF_COMMAND, 0, 910 stdout); 911 } 912 913 /* Prepare next round. */ 914 pkt_count++; 915 pkt_ptr += pkt_size; 916 img_size -= pkt_size; 917 } while(!last_pkt); 918 bailout: 919 if (quiet == 0) 920 progress_complete(&progress, size - img_size); 921 cam_freeccb(ccb); 922 return (retval); 923 } 924 925 int 926 fwdownload(struct cam_device *device, int argc, char **argv, 927 char *combinedopt, int printerrors, int task_attr, int retry_count, 928 int timeout) 929 { 930 union ccb *ccb = NULL; 931 struct fw_vendor *vp; 932 char *fw_img_path = NULL; 933 struct ata_params *ident_buf = NULL; 934 camcontrol_devtype devtype; 935 char *buf = NULL; 936 int img_size; 937 int c; 938 int sim_mode = 0; 939 int confirmed = 0; 940 int quiet = 0; 941 int retval = 0; 942 943 while ((c = getopt(argc, argv, combinedopt)) != -1) { 944 switch (c) { 945 case 'f': 946 fw_img_path = optarg; 947 break; 948 case 'q': 949 quiet = 1; 950 break; 951 case 's': 952 sim_mode = 1; 953 break; 954 case 'y': 955 confirmed = 1; 956 break; 957 default: 958 break; 959 } 960 } 961 962 if (fw_img_path == NULL) 963 errx(1, "you must specify a firmware image file using -f " 964 "option"); 965 966 retval = get_device_type(device, retry_count, timeout, printerrors, 967 &devtype); 968 if (retval != 0) 969 errx(1, "Unable to determine device type"); 970 971 if ((devtype == CC_DT_ATA) 972 || (devtype == CC_DT_SATL)) { 973 ccb = cam_getccb(device); 974 if (ccb == NULL) { 975 warnx("couldn't allocate CCB"); 976 retval = 1; 977 goto bailout; 978 } 979 980 if (ata_do_identify(device, retry_count, timeout, ccb, 981 &ident_buf) != 0) { 982 retval = 1; 983 goto bailout; 984 } 985 } else if (devtype != CC_DT_SCSI) 986 errx(1, "Unsupported device type %d", devtype); 987 988 vp = fw_get_vendor(device, ident_buf); 989 /* 990 * Bail out if we have an unknown vendor and this isn't an ATA 991 * disk. For a SCSI disk, we have no chance of working properly 992 * with the default values in the VENDOR_UNKNOWN case. For an ATA 993 * disk connected via an ATA transport, we may work for drives that 994 * support the ATA_DOWNLOAD_MICROCODE command. 995 */ 996 if (((vp == NULL) 997 || (vp->type == VENDOR_UNKNOWN)) 998 && (devtype == CC_DT_SCSI)) 999 errx(1, "Unsupported device"); 1000 1001 retval = fw_get_timeout(device, vp, task_attr, retry_count, timeout); 1002 if (retval != 0) { 1003 warnx("Unable to get a firmware download timeout value"); 1004 goto bailout; 1005 } 1006 1007 buf = fw_read_img(device, retry_count, timeout, quiet, fw_img_path, 1008 vp, &img_size); 1009 if (buf == NULL) { 1010 retval = 1; 1011 goto bailout; 1012 } 1013 1014 if (!confirmed) { 1015 fprintf(stdout, "You are about to download firmware image (%s)" 1016 " into the following device:\n", 1017 fw_img_path); 1018 if (devtype == CC_DT_SCSI) { 1019 if (scsidoinquiry(device, argc, argv, combinedopt, 1020 MSG_SIMPLE_Q_TAG, 0, 5000) != 0) { 1021 warnx("Error sending inquiry"); 1022 retval = 1; 1023 goto bailout; 1024 } 1025 } else { 1026 printf("%s%d: ", device->device_name, 1027 device->dev_unit_num); 1028 ata_print_ident(ident_buf); 1029 camxferrate(device); 1030 free(ident_buf); 1031 } 1032 fprintf(stdout, "Using a timeout of %u ms, which is %s.\n", 1033 vp->timeout_ms, 1034 fw_timeout_desc_table[vp->timeout_type].timeout_desc); 1035 fprintf(stdout, "\nIt may damage your drive. "); 1036 if (!get_confirmation()) { 1037 retval = 1; 1038 goto bailout; 1039 } 1040 } 1041 if ((sim_mode != 0) && (quiet == 0)) 1042 fprintf(stdout, "Running in simulation mode\n"); 1043 1044 if (fw_download_img(device, vp, buf, img_size, sim_mode, printerrors, 1045 quiet, retry_count, vp->timeout_ms, fw_img_path, devtype) != 0) { 1046 fprintf(stderr, "Firmware download failed\n"); 1047 retval = 1; 1048 goto bailout; 1049 } else if (quiet == 0) 1050 fprintf(stdout, "Firmware download successful\n"); 1051 1052 bailout: 1053 cam_freeccb(ccb); 1054 free(buf); 1055 return (retval); 1056 } 1057 1058