1 /*- 2 * Copyright (c) 2011 Sandvine Incorporated. All rights reserved. 3 * Copyright (c) 2002-2011 Andre Albsmeier <andre@albsmeier.net> 4 * All rights reserved. 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that the following conditions 8 * are met: 9 * 1. Redistributions of source code must retain the above copyright 10 * notice, this list of conditions and the following disclaimer, 11 * without modification, immediately at the beginning of the file. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 17 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 18 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 19 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 20 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 21 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 22 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 23 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 24 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 25 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 26 */ 27 28 /* 29 * This software is derived from Andre Albsmeier's fwprog.c which contained 30 * the following note: 31 * 32 * Many thanks goes to Marc Frajola <marc@terasolutions.com> from 33 * TeraSolutions for the initial idea and his programme for upgrading 34 * the firmware of I*M DDYS drives. 35 */ 36 37 /* 38 * BEWARE: 39 * 40 * The fact that you see your favorite vendor listed below does not 41 * imply that your equipment won't break when you use this software 42 * with it. It only means that the firmware of at least one device type 43 * of each vendor listed has been programmed successfully using this code. 44 * 45 * The -s option simulates a download but does nothing apart from that. 46 * It can be used to check what chunk sizes would have been used with the 47 * specified device. 48 */ 49 50 #include <sys/cdefs.h> 51 __FBSDID("$FreeBSD$"); 52 53 #include <sys/types.h> 54 #include <sys/stat.h> 55 56 #include <err.h> 57 #include <fcntl.h> 58 #include <stdio.h> 59 #include <stdlib.h> 60 #include <string.h> 61 #include <unistd.h> 62 63 #include <cam/scsi/scsi_all.h> 64 #include <cam/scsi/scsi_message.h> 65 #include <camlib.h> 66 67 #include "progress.h" 68 69 #include "camcontrol.h" 70 71 #define CMD_TIMEOUT 50000 /* 50 seconds */ 72 73 typedef enum { 74 VENDOR_HITACHI, 75 VENDOR_HP, 76 VENDOR_IBM, 77 VENDOR_PLEXTOR, 78 VENDOR_QUALSTAR, 79 VENDOR_QUANTUM, 80 VENDOR_SAMSUNG, 81 VENDOR_SEAGATE, 82 VENDOR_UNKNOWN 83 } fw_vendor_t; 84 85 struct fw_vendor { 86 fw_vendor_t type; 87 const char *pattern; 88 int max_pkt_size; 89 u_int8_t cdb_byte2; 90 u_int8_t cdb_byte2_last; 91 int inc_cdb_buffer_id; 92 int inc_cdb_offset; 93 }; 94 95 static const struct fw_vendor vendors_list[] = { 96 {VENDOR_HITACHI, "HITACHI", 0x8000, 0x05, 0x05, 1, 0}, 97 {VENDOR_HP, "HP", 0x8000, 0x07, 0x07, 0, 1}, 98 {VENDOR_IBM, "IBM", 0x8000, 0x05, 0x05, 1, 0}, 99 {VENDOR_PLEXTOR, "PLEXTOR", 0x2000, 0x04, 0x05, 0, 1}, 100 {VENDOR_QUALSTAR, "QUALSTAR", 0x2030, 0x05, 0x05, 0, 0}, 101 {VENDOR_QUANTUM, "QUANTUM", 0x2000, 0x04, 0x05, 0, 1}, 102 {VENDOR_SAMSUNG, "SAMSUNG", 0x8000, 0x07, 0x07, 0, 1}, 103 {VENDOR_SEAGATE, "SEAGATE", 0x8000, 0x07, 0x07, 0, 1}, 104 /* the next 2 are SATA disks going through SAS HBA */ 105 {VENDOR_SEAGATE, "ATA ST", 0x8000, 0x07, 0x07, 0, 1}, 106 {VENDOR_HITACHI, "ATA HDS", 0x8000, 0x05, 0x05, 1, 0}, 107 {VENDOR_UNKNOWN, NULL, 0x0000, 0x00, 0x00, 0, 0} 108 }; 109 110 #ifndef ATA_DOWNLOAD_MICROCODE 111 #define ATA_DOWNLOAD_MICROCODE 0x92 112 #endif 113 114 #define USE_OFFSETS_FEATURE 0x3 115 116 #ifndef LOW_SECTOR_SIZE 117 #define LOW_SECTOR_SIZE 512 118 #endif 119 120 #define ATA_MAKE_LBA(o, p) \ 121 ((((((o) / LOW_SECTOR_SIZE) >> 8) & 0xff) << 16) | \ 122 ((((o) / LOW_SECTOR_SIZE) & 0xff) << 8) | \ 123 ((((p) / LOW_SECTOR_SIZE) >> 8) & 0xff)) 124 125 #define ATA_MAKE_SECTORS(p) (((p) / 512) & 0xff) 126 127 #ifndef UNKNOWN_MAX_PKT_SIZE 128 #define UNKNOWN_MAX_PKT_SIZE 0x8000 129 #endif 130 131 static const struct fw_vendor *fw_get_vendor(struct cam_device *cam_dev); 132 static char *fw_read_img(const char *fw_img_path, 133 const struct fw_vendor *vp, int *num_bytes); 134 static int fw_download_img(struct cam_device *cam_dev, 135 const struct fw_vendor *vp, char *buf, int img_size, 136 int sim_mode, int printerrors, int retry_count, int timeout, 137 const char */*name*/, const char */*type*/); 138 139 /* 140 * Find entry in vendors list that belongs to 141 * the vendor of given cam device. 142 */ 143 static const struct fw_vendor * 144 fw_get_vendor(struct cam_device *cam_dev) 145 { 146 char vendor[SID_VENDOR_SIZE + 1]; 147 const struct fw_vendor *vp; 148 149 if (cam_dev == NULL) 150 return (NULL); 151 cam_strvis((u_char *)vendor, (u_char *)cam_dev->inq_data.vendor, 152 sizeof(cam_dev->inq_data.vendor), sizeof(vendor)); 153 for (vp = vendors_list; vp->pattern != NULL; vp++) { 154 if (!cam_strmatch((const u_char *)vendor, 155 (const u_char *)vp->pattern, strlen(vendor))) 156 break; 157 } 158 return (vp); 159 } 160 161 /* 162 * Allocate a buffer and read fw image file into it 163 * from given path. Number of bytes read is stored 164 * in num_bytes. 165 */ 166 static char * 167 fw_read_img(const char *fw_img_path, const struct fw_vendor *vp, int *num_bytes) 168 { 169 int fd; 170 struct stat stbuf; 171 char *buf; 172 off_t img_size; 173 int skip_bytes = 0; 174 175 if ((fd = open(fw_img_path, O_RDONLY)) < 0) { 176 warn("Could not open image file %s", fw_img_path); 177 return (NULL); 178 } 179 if (fstat(fd, &stbuf) < 0) { 180 warn("Could not stat image file %s", fw_img_path); 181 goto bailout1; 182 } 183 if ((img_size = stbuf.st_size) == 0) { 184 warnx("Zero length image file %s", fw_img_path); 185 goto bailout1; 186 } 187 if ((buf = malloc(img_size)) == NULL) { 188 warnx("Could not allocate buffer to read image file %s", 189 fw_img_path); 190 goto bailout1; 191 } 192 /* Skip headers if applicable. */ 193 switch (vp->type) { 194 case VENDOR_SEAGATE: 195 if (read(fd, buf, 16) != 16) { 196 warn("Could not read image file %s", fw_img_path); 197 goto bailout; 198 } 199 if (lseek(fd, 0, SEEK_SET) == -1) { 200 warn("Unable to lseek"); 201 goto bailout; 202 } 203 if ((strncmp(buf, "SEAGATE,SEAGATE ", 16) == 0) || 204 (img_size % 512 == 80)) 205 skip_bytes = 80; 206 break; 207 case VENDOR_QUALSTAR: 208 skip_bytes = img_size % 1030; 209 break; 210 default: 211 break; 212 } 213 if (skip_bytes != 0) { 214 fprintf(stdout, "Skipping %d byte header.\n", skip_bytes); 215 if (lseek(fd, skip_bytes, SEEK_SET) == -1) { 216 warn("Could not lseek"); 217 goto bailout; 218 } 219 img_size -= skip_bytes; 220 } 221 /* Read image into a buffer. */ 222 if (read(fd, buf, img_size) != img_size) { 223 warn("Could not read image file %s", fw_img_path); 224 goto bailout; 225 } 226 *num_bytes = img_size; 227 close(fd); 228 return (buf); 229 bailout: 230 free(buf); 231 bailout1: 232 close(fd); 233 *num_bytes = 0; 234 return (NULL); 235 } 236 237 /* 238 * Download firmware stored in buf to cam_dev. If simulation mode 239 * is enabled, only show what packet sizes would be sent to the 240 * device but do not sent any actual packets 241 */ 242 static int 243 fw_download_img(struct cam_device *cam_dev, const struct fw_vendor *vp, 244 char *buf, int img_size, int sim_mode, int printerrors, int retry_count, 245 int timeout, const char *imgname, const char *type) 246 { 247 struct scsi_write_buffer cdb; 248 progress_t progress; 249 int size; 250 union ccb *ccb; 251 int pkt_count = 0; 252 int max_pkt_size; 253 u_int32_t pkt_size = 0; 254 char *pkt_ptr = buf; 255 u_int32_t offset; 256 int last_pkt = 0; 257 int16_t *ptr; 258 259 if ((ccb = cam_getccb(cam_dev)) == NULL) { 260 warnx("Could not allocate CCB"); 261 return (1); 262 } 263 if (strcmp(type, "scsi") == 0) { 264 scsi_test_unit_ready(&ccb->csio, 0, NULL, MSG_SIMPLE_Q_TAG, 265 SSD_FULL_SIZE, 5000); 266 } else if (strcmp(type, "ata") == 0) { 267 /* cam_getccb cleans up the header, caller has to zero the payload */ 268 bzero(&(&ccb->ccb_h)[1], 269 sizeof(struct ccb_ataio) - sizeof(struct ccb_hdr)); 270 271 ptr = (uint16_t *)malloc(sizeof(struct ata_params)); 272 273 if (ptr == NULL) { 274 cam_freeccb(ccb); 275 warnx("can't malloc memory for identify\n"); 276 return(1); 277 } 278 bzero(ptr, sizeof(struct ata_params)); 279 cam_fill_ataio(&ccb->ataio, 280 1, 281 NULL, 282 /*flags*/CAM_DIR_IN, 283 MSG_SIMPLE_Q_TAG, 284 /*data_ptr*/(uint8_t *)ptr, 285 /*dxfer_len*/sizeof(struct ata_params), 286 timeout ? timeout : 30 * 1000); 287 ata_28bit_cmd(&ccb->ataio, ATA_ATA_IDENTIFY, 0, 0, 0); 288 } else { 289 warnx("weird disk type '%s'", type); 290 cam_freeccb(ccb); 291 return 1; 292 } 293 /* Disable freezing the device queue. */ 294 ccb->ccb_h.flags |= CAM_DEV_QFRZDIS; 295 if (cam_send_ccb(cam_dev, ccb) < 0) { 296 warnx("Error sending identify/test unit ready"); 297 if (printerrors) 298 cam_error_print(cam_dev, ccb, CAM_ESF_ALL, 299 CAM_EPF_ALL, stderr); 300 cam_freeccb(ccb); 301 return(1); 302 } 303 if ((ccb->ccb_h.status & CAM_STATUS_MASK) != CAM_REQ_CMP) { 304 warnx("Device is not ready"); 305 if (printerrors) 306 cam_error_print(cam_dev, ccb, CAM_ESF_ALL, 307 CAM_EPF_ALL, stderr); 308 cam_freeccb(ccb); 309 return (1); 310 } 311 max_pkt_size = vp->max_pkt_size; 312 if (vp->max_pkt_size == 0 && strcmp(type, "ata") == 0) { 313 max_pkt_size = UNKNOWN_MAX_PKT_SIZE; 314 } 315 pkt_size = vp->max_pkt_size; 316 progress_init(&progress, imgname, size = img_size); 317 /* Download single fw packets. */ 318 do { 319 if (img_size <= max_pkt_size) { 320 last_pkt = 1; 321 pkt_size = img_size; 322 } 323 progress_update(&progress, size - img_size); 324 progress_draw(&progress); 325 bzero(&cdb, sizeof(cdb)); 326 if (strcmp(type, "scsi") == 0) { 327 cdb.opcode = WRITE_BUFFER; 328 cdb.control = 0; 329 /* Parameter list length. */ 330 scsi_ulto3b(pkt_size, &cdb.length[0]); 331 offset = vp->inc_cdb_offset ? (pkt_ptr - buf) : 0; 332 scsi_ulto3b(offset, &cdb.offset[0]); 333 cdb.byte2 = last_pkt ? vp->cdb_byte2_last : vp->cdb_byte2; 334 cdb.buffer_id = vp->inc_cdb_buffer_id ? pkt_count : 0; 335 /* Zero out payload of ccb union after ccb header. */ 336 bzero((u_char *)ccb + sizeof(struct ccb_hdr), 337 sizeof(struct ccb_scsiio) - sizeof(struct ccb_hdr)); 338 /* Copy previously constructed cdb into ccb_scsiio struct. */ 339 bcopy(&cdb, &ccb->csio.cdb_io.cdb_bytes[0], 340 sizeof(struct scsi_write_buffer)); 341 /* Fill rest of ccb_scsiio struct. */ 342 if (!sim_mode) { 343 cam_fill_csio(&ccb->csio, /* ccb_scsiio */ 344 retry_count, /* retries */ 345 NULL, /* cbfcnp */ 346 CAM_DIR_OUT | CAM_DEV_QFRZDIS, /* flags */ 347 CAM_TAG_ACTION_NONE, /* tag_action */ 348 (u_char *)pkt_ptr, /* data_ptr */ 349 pkt_size, /* dxfer_len */ 350 SSD_FULL_SIZE, /* sense_len */ 351 sizeof(struct scsi_write_buffer), /* cdb_len */ 352 timeout ? timeout : CMD_TIMEOUT); /* timeout */ 353 } 354 } else if (strcmp(type, "ata") == 0) { 355 bzero(&(&ccb->ccb_h)[1], 356 sizeof(struct ccb_ataio) - sizeof(struct ccb_hdr)); 357 if (!sim_mode) { 358 uint32_t off; 359 360 cam_fill_ataio(&ccb->ataio, 361 (last_pkt) ? 256 : retry_count, 362 NULL, 363 /*flags*/CAM_DIR_OUT | CAM_DEV_QFRZDIS, 364 CAM_TAG_ACTION_NONE, 365 /*data_ptr*/(uint8_t *)pkt_ptr, 366 /*dxfer_len*/pkt_size, 367 timeout ? timeout : 30 * 1000); 368 off = (uint32_t)(pkt_ptr - buf); 369 ata_28bit_cmd(&ccb->ataio, ATA_DOWNLOAD_MICROCODE, 370 USE_OFFSETS_FEATURE, 371 ATA_MAKE_LBA(off, pkt_size), 372 ATA_MAKE_SECTORS(pkt_size)); 373 } 374 } 375 if (!sim_mode) { 376 /* Execute the command. */ 377 if (cam_send_ccb(cam_dev, ccb) < 0 || 378 (ccb->ccb_h.status & CAM_STATUS_MASK) != 379 CAM_REQ_CMP) { 380 warnx("Error writing image to device"); 381 if (printerrors) 382 cam_error_print(cam_dev, ccb, CAM_ESF_ALL, 383 CAM_EPF_ALL, stderr); 384 goto bailout; 385 } 386 } 387 /* Prepare next round. */ 388 pkt_count++; 389 pkt_ptr += pkt_size; 390 img_size -= pkt_size; 391 } while(!last_pkt); 392 progress_complete(&progress, size - img_size); 393 cam_freeccb(ccb); 394 return (0); 395 bailout: 396 progress_complete(&progress, size - img_size); 397 cam_freeccb(ccb); 398 return (1); 399 } 400 401 int 402 fwdownload(struct cam_device *device, int argc, char **argv, 403 char *combinedopt, int printerrors, int retry_count, int timeout, 404 const char *type) 405 { 406 const struct fw_vendor *vp; 407 char *fw_img_path = NULL; 408 char *buf; 409 int img_size; 410 int c; 411 int sim_mode = 0; 412 int confirmed = 0; 413 414 while ((c = getopt(argc, argv, combinedopt)) != -1) { 415 switch (c) { 416 case 's': 417 sim_mode = 1; 418 confirmed = 1; 419 break; 420 case 'f': 421 fw_img_path = optarg; 422 break; 423 case 'y': 424 confirmed = 1; 425 break; 426 default: 427 break; 428 } 429 } 430 431 if (fw_img_path == NULL) 432 errx(1, "you must specify a firmware image file using -f option"); 433 434 vp = fw_get_vendor(device); 435 if (vp == NULL) 436 errx(1, "NULL vendor"); 437 if (vp->type == VENDOR_UNKNOWN) 438 warnx("Unsupported device - flashing through an HBA?"); 439 440 buf = fw_read_img(fw_img_path, vp, &img_size); 441 if (buf == NULL) 442 goto fail; 443 444 if (!confirmed) { 445 fprintf(stdout, "You are about to download firmware image (%s)" 446 " into the following device:\n", 447 fw_img_path); 448 fprintf(stdout, "\nIt may damage your drive. "); 449 if (!get_confirmation()) 450 goto fail; 451 } 452 if (sim_mode) 453 fprintf(stdout, "Running in simulation mode\n"); 454 455 if (fw_download_img(device, vp, buf, img_size, sim_mode, printerrors, 456 retry_count, timeout, fw_img_path, type) != 0) { 457 fprintf(stderr, "Firmware download failed\n"); 458 goto fail; 459 } 460 else 461 fprintf(stdout, "Firmware download successful\n"); 462 463 free(buf); 464 return (0); 465 fail: 466 if (buf != NULL) 467 free(buf); 468 return (1); 469 } 470 471