xref: /freebsd/sbin/camcontrol/fwdownload.c (revision ec65e4f8d0654361df5e97d4de3518edebf76b46)
1 /*-
2  * Copyright (c) 2011 Sandvine Incorporated. All rights reserved.
3  * Copyright (c) 2002-2011 Andre Albsmeier <andre@albsmeier.net>
4  * All rights reserved.
5  *
6  * Redistribution and use in source and binary forms, with or without
7  * modification, are permitted provided that the following conditions
8  * are met:
9  * 1. Redistributions of source code must retain the above copyright
10  *    notice, this list of conditions and the following disclaimer,
11  *    without modification, immediately at the beginning of the file.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  *
16  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
17  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
18  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
19  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
20  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
21  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
22  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
23  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
24  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
25  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
26  */
27 
28 /*
29  * This software is derived from Andre Albsmeier's fwprog.c which contained
30  * the following note:
31  *
32  * Many thanks goes to Marc Frajola <marc@terasolutions.com> from
33  * TeraSolutions for the initial idea and his programme for upgrading
34  * the firmware of I*M DDYS drives.
35  */
36 
37 /*
38  * BEWARE:
39  *
40  * The fact that you see your favorite vendor listed below does not
41  * imply that your equipment won't break when you use this software
42  * with it. It only means that the firmware of at least one device type
43  * of each vendor listed has been programmed successfully using this code.
44  *
45  * The -s option simulates a download but does nothing apart from that.
46  * It can be used to check what chunk sizes would have been used with the
47  * specified device.
48  */
49 
50 #include <sys/cdefs.h>
51 __FBSDID("$FreeBSD$");
52 
53 #include <sys/types.h>
54 #include <sys/stat.h>
55 
56 #include <err.h>
57 #include <fcntl.h>
58 #include <stdio.h>
59 #include <stdlib.h>
60 #include <string.h>
61 #include <unistd.h>
62 
63 #include <cam/scsi/scsi_all.h>
64 #include <cam/scsi/scsi_message.h>
65 #include <camlib.h>
66 
67 #include "progress.h"
68 
69 #include "camcontrol.h"
70 
71 #define	WB_TIMEOUT 50000	/* 50 seconds */
72 
73 typedef enum {
74 	VENDOR_HGST,
75 	VENDOR_HITACHI,
76 	VENDOR_HP,
77 	VENDOR_IBM,
78 	VENDOR_PLEXTOR,
79 	VENDOR_QUALSTAR,
80 	VENDOR_QUANTUM,
81 	VENDOR_SAMSUNG,
82 	VENDOR_SEAGATE,
83 	VENDOR_SMART,
84 	VENDOR_ATA,
85 	VENDOR_UNKNOWN
86 } fw_vendor_t;
87 
88 /*
89  * FW_TUR_READY:     The drive must return good status for a test unit ready.
90  *
91  * FW_TUR_NOT_READY: The drive must return not ready status for a test unit
92  *		     ready.  You may want this in a removable media drive.
93  *
94  * FW_TUR_NA:	     It doesn't matter whether the drive is ready or not.
95  * 		     This may be the case for a removable media drive.
96  */
97 typedef enum {
98 	FW_TUR_NONE,
99 	FW_TUR_READY,
100 	FW_TUR_NOT_READY,
101 	FW_TUR_NA
102 } fw_tur_status;
103 
104 /*
105  * FW_TIMEOUT_DEFAULT:		Attempt to probe for a WRITE BUFFER timeout
106  *				value from the drive.  If we get an answer,
107  *				use the Recommended timeout.  Otherwise,
108  * 				use the default value from the table.
109  *
110  * FW_TIMEOUT_DEV_REPORTED:	The timeout value was probed directly from
111  *				the device.
112  *
113  * FW_TIMEOUT_NO_PROBE:		Do not ask the device for a WRITE BUFFER
114  * 				timeout value.  Use the device-specific
115  *				value.
116  *
117  * FW_TIMEOUT_USER_SPEC:	The user specified a timeout on the command
118  *				line with the -t option.  This overrides any
119  *				probe or default timeout.
120  */
121 typedef enum {
122 	FW_TIMEOUT_DEFAULT,
123 	FW_TIMEOUT_DEV_REPORTED,
124 	FW_TIMEOUT_NO_PROBE,
125 	FW_TIMEOUT_USER_SPEC
126 } fw_timeout_type;
127 
128 /*
129  * type: 		Enumeration for the particular vendor.
130  *
131  * pattern:		Pattern to match for the Vendor ID from the SCSI
132  *			Inquiry data.
133  *
134  * dev_type:		SCSI device type to match, or T_ANY to match any
135  *			device from the given vendor.  Note that if there
136  *			is a specific device type listed for a particular
137  *			vendor, it must be listed before a T_ANY entry.
138  *
139  * max_pkt_size:	Maximum packet size when talking to a device.  Note
140  *			that although large data sizes may be supported by
141  *			the target device, they may not be supported by the
142  *			OS or the controller.
143  *
144  * cdb_byte2:		This specifies byte 2 (byte 1 when counting from 0)
145  *			of the CDB.  This is generally the WRITE BUFFER mode.
146  *
147  * cdb_byte2_last:	This specifies byte 2 for the last chunk of the
148  *			download.
149  *
150  * inc_cdb_buffer_id:	Increment the buffer ID by 1 for each chunk sent
151  *			down to the drive.
152  *
153  * inc_cdb_offset:	Increment the offset field in the CDB with the byte
154  *			offset into the firmware file.
155  *
156  * tur_status:		Pay attention to whether the device is ready before
157  *			upgrading the firmware, or not.  See above for the
158  *			values.
159  */
160 struct fw_vendor {
161 	fw_vendor_t type;
162 	const char *pattern;
163 	int dev_type;
164 	int max_pkt_size;
165 	u_int8_t cdb_byte2;
166 	u_int8_t cdb_byte2_last;
167 	int inc_cdb_buffer_id;
168 	int inc_cdb_offset;
169 	fw_tur_status tur_status;
170 	int timeout_ms;
171 	fw_timeout_type timeout_type;
172 };
173 
174 /*
175  * Vendor notes:
176  *
177  * HGST:     The packets need to be sent in multiples of 4K.
178  *
179  * IBM:      For LTO and TS drives, the buffer ID is ignored in mode 7 (and
180  * 	     some other modes).  It treats the request as a firmware download.
181  *           The offset (and therefore the length of each chunk sent) needs
182  *           to be a multiple of the offset boundary specified for firmware
183  *           (buffer ID 4) in the read buffer command.  At least for LTO-6,
184  *           that seems to be 0, but using a 32K chunk size should satisfy
185  *           most any alignment requirement.
186  *
187  * SmrtStor: Mode 5 is also supported, but since the firmware is 400KB or
188  *           so, we can't fit it in a single request in most cases.
189  */
190 static struct fw_vendor vendors_list[] = {
191 	{VENDOR_HGST,	 	"HGST",		T_DIRECT,
192 	0x1000, 0x07, 0x07, 1, 0, FW_TUR_READY, WB_TIMEOUT, FW_TIMEOUT_DEFAULT},
193 	{VENDOR_HITACHI, 	"HITACHI",	T_ANY,
194 	0x8000, 0x05, 0x05, 1, 0, FW_TUR_READY, WB_TIMEOUT, FW_TIMEOUT_DEFAULT},
195 	{VENDOR_HP,	 	"HP",		T_ANY,
196 	0x8000, 0x07, 0x07, 0, 1, FW_TUR_READY, WB_TIMEOUT, FW_TIMEOUT_DEFAULT},
197 	{VENDOR_IBM,		"IBM",		T_SEQUENTIAL,
198 	0x8000, 0x07, 0x07, 0, 1, FW_TUR_NA, 300 * 1000, FW_TIMEOUT_DEFAULT},
199 	{VENDOR_IBM,		"IBM",		T_ANY,
200 	0x8000, 0x05, 0x05, 1, 0, FW_TUR_READY, WB_TIMEOUT, FW_TIMEOUT_DEFAULT},
201 	{VENDOR_PLEXTOR,	"PLEXTOR",	T_ANY,
202 	0x2000, 0x04, 0x05, 0, 1, FW_TUR_READY, WB_TIMEOUT, FW_TIMEOUT_DEFAULT},
203 	{VENDOR_QUALSTAR,	"QUALSTAR",	T_ANY,
204 	0x2030, 0x05, 0x05, 0, 0, FW_TUR_READY, WB_TIMEOUT, FW_TIMEOUT_DEFAULT},
205 	{VENDOR_QUANTUM,	"QUANTUM",	T_ANY,
206 	0x2000, 0x04, 0x05, 0, 1, FW_TUR_READY, WB_TIMEOUT, FW_TIMEOUT_DEFAULT},
207 	{VENDOR_SAMSUNG,	"SAMSUNG",	T_ANY,
208 	0x8000, 0x07, 0x07, 0, 1, FW_TUR_READY, WB_TIMEOUT, FW_TIMEOUT_DEFAULT},
209 	{VENDOR_SEAGATE,	"SEAGATE",	T_ANY,
210 	0x8000, 0x07, 0x07, 0, 1, FW_TUR_READY, WB_TIMEOUT, FW_TIMEOUT_DEFAULT},
211 	{VENDOR_SMART,		"SmrtStor",	T_DIRECT,
212 	0x8000, 0x07, 0x07, 0, 1, FW_TUR_READY, WB_TIMEOUT, FW_TIMEOUT_DEFAULT},
213 
214 	/*
215 	 * We match any ATA device.  This is really just a placeholder,
216 	 * since we won't actually send a WRITE BUFFER with any of the
217 	 * listed parameters.  If a SATA device is behind a SAS controller,
218 	 * the SCSI to ATA translation code (at least for LSI) doesn't
219 	 * generally translate a SCSI WRITE BUFFER into an ATA DOWNLOAD
220 	 * MICROCODE command.  So, we use the SCSI ATA PASS_THROUGH command
221 	 * to send the ATA DOWNLOAD MICROCODE command instead.
222 	 */
223 	{VENDOR_ATA,		"ATA",		T_ANY,
224 	 0x8000, 0x07, 0x07, 0, 1, FW_TUR_READY, WB_TIMEOUT,
225 	 FW_TIMEOUT_NO_PROBE},
226 	{VENDOR_UNKNOWN,	NULL,		T_ANY,
227 	0x0000, 0x00, 0x00, 0, 0, FW_TUR_NONE, WB_TIMEOUT, FW_TIMEOUT_DEFAULT}
228 };
229 
230 struct fw_timeout_desc {
231 	fw_timeout_type timeout_type;
232 	const char *timeout_desc;
233 };
234 
235 static const struct fw_timeout_desc fw_timeout_desc_table[] = {
236 	{ FW_TIMEOUT_DEFAULT, "the default" },
237 	{ FW_TIMEOUT_DEV_REPORTED, "recommended by this particular device" },
238 	{ FW_TIMEOUT_NO_PROBE, "the default" },
239 	{ FW_TIMEOUT_USER_SPEC, "what was specified on the command line" }
240 };
241 
242 #ifndef ATA_DOWNLOAD_MICROCODE
243 #define ATA_DOWNLOAD_MICROCODE	0x92
244 #endif
245 
246 #define USE_OFFSETS_FEATURE	0x3
247 
248 #ifndef LOW_SECTOR_SIZE
249 #define LOW_SECTOR_SIZE		512
250 #endif
251 
252 #define ATA_MAKE_LBA(o, p)	\
253 	((((((o) / LOW_SECTOR_SIZE) >> 8) & 0xff) << 16) | \
254 	  ((((o) / LOW_SECTOR_SIZE) & 0xff) << 8) | \
255 	  ((((p) / LOW_SECTOR_SIZE) >> 8) & 0xff))
256 
257 #define ATA_MAKE_SECTORS(p)	(((p) / 512) & 0xff)
258 
259 #ifndef UNKNOWN_MAX_PKT_SIZE
260 #define UNKNOWN_MAX_PKT_SIZE	0x8000
261 #endif
262 
263 static struct fw_vendor *fw_get_vendor(struct cam_device *cam_dev,
264 				       struct ata_params *ident_buf);
265 static int fw_get_timeout(struct cam_device *cam_dev, struct fw_vendor *vp,
266 			  int retry_count, int timeout);
267 static int fw_validate_ibm(struct cam_device *dev, int retry_count,
268 			   int timeout, int fd, char *buf,
269 			    const char *fw_img_path, int quiet);
270 static char *fw_read_img(struct cam_device *dev, int retry_count,
271 			 int timeout, int quiet, const char *fw_img_path,
272 			 struct fw_vendor *vp, int *num_bytes);
273 static int fw_check_device_ready(struct cam_device *dev,
274 				 camcontrol_devtype devtype,
275 				 struct fw_vendor *vp, int printerrors,
276 				 int timeout);
277 static int fw_download_img(struct cam_device *cam_dev,
278 			   struct fw_vendor *vp, char *buf, int img_size,
279 			   int sim_mode, int printerrors, int quiet,
280 			   int retry_count, int timeout, const char */*name*/,
281 			   camcontrol_devtype devtype);
282 
283 /*
284  * Find entry in vendors list that belongs to
285  * the vendor of given cam device.
286  */
287 static struct fw_vendor *
288 fw_get_vendor(struct cam_device *cam_dev, struct ata_params *ident_buf)
289 {
290 	char vendor[42];
291 	struct fw_vendor *vp;
292 
293 	if (cam_dev == NULL)
294 		return (NULL);
295 
296 	if (ident_buf != NULL) {
297 		cam_strvis((u_char *)vendor, ident_buf->model,
298 		    sizeof(ident_buf->model), sizeof(vendor));
299 		for (vp = vendors_list; vp->pattern != NULL; vp++) {
300 			if (vp->type == VENDOR_ATA)
301 				return (vp);
302 		}
303 	} else {
304 		cam_strvis((u_char *)vendor, (u_char *)cam_dev->inq_data.vendor,
305 		    sizeof(cam_dev->inq_data.vendor), sizeof(vendor));
306 	}
307 	for (vp = vendors_list; vp->pattern != NULL; vp++) {
308 		if (!cam_strmatch((const u_char *)vendor,
309 		    (const u_char *)vp->pattern, strlen(vendor))) {
310 			if ((vp->dev_type == T_ANY)
311 			 || (vp->dev_type == SID_TYPE(&cam_dev->inq_data)))
312 				break;
313 		}
314 	}
315 	return (vp);
316 }
317 
318 static int
319 fw_get_timeout(struct cam_device *cam_dev, struct fw_vendor *vp,
320 	       int retry_count, int timeout)
321 {
322 	struct scsi_report_supported_opcodes_one *one;
323 	struct scsi_report_supported_opcodes_timeout *td;
324 	uint8_t *buf = NULL;
325 	uint32_t fill_len = 0, cdb_len = 0, rec_timeout = 0;
326 	int retval = 0;
327 
328 	/*
329 	 * If the user has specified a timeout on the command line, we let
330 	 * him override any default or probed value.
331 	 */
332 	if (timeout != 0) {
333 		vp->timeout_type = FW_TIMEOUT_USER_SPEC;
334 		vp->timeout_ms = timeout;
335 		goto bailout;
336 	}
337 
338 	/*
339 	 * Check to see whether we should probe for a timeout for this
340 	 * device.
341 	 */
342 	if (vp->timeout_type == FW_TIMEOUT_NO_PROBE)
343 		goto bailout;
344 
345 	retval = scsigetopcodes(/*device*/ cam_dev,
346 				/*opcode_set*/ 1,
347 				/*opcode*/ WRITE_BUFFER,
348 				/*show_sa_errors*/ 1,
349 				/*sa_set*/ 0,
350 				/*service_action*/ 0,
351 				/*timeout_desc*/ 1,
352 				/*retry_count*/ retry_count,
353 				/*timeout*/ 10000,
354 				/*verbose*/ 0,
355 				/*fill_len*/ &fill_len,
356 				/*data_ptr*/ &buf);
357 	/*
358 	 * It isn't an error if we can't get a timeout descriptor.  We just
359 	 * continue on with the default timeout.
360 	 */
361 	if (retval != 0) {
362 		retval = 0;
363 		goto bailout;
364 	}
365 
366 	/*
367 	 * Even if the drive didn't return a SCSI error, if we don't have
368 	 * enough data to contain the one opcode descriptor, the CDB
369 	 * structure and a timeout descriptor, we don't have the timeout
370 	 * value we're looking for.  So we'll just fall back to the
371 	 * default value.
372 	 */
373 	if (fill_len < (sizeof(*one) + sizeof(struct scsi_write_buffer) +
374 	    sizeof(*td)))
375 		goto bailout;
376 
377 	one = (struct scsi_report_supported_opcodes_one *)buf;
378 
379 	/*
380 	 * If the drive claims to not support the WRITE BUFFER command...
381 	 * fall back to the default timeout value and let things fail on
382 	 * the actual firmware download.
383 	 */
384 	if ((one->support & RSO_ONE_SUP_MASK) == RSO_ONE_SUP_NOT_SUP)
385 		goto bailout;
386 
387 	cdb_len = scsi_2btoul(one->cdb_length);
388 	td = (struct scsi_report_supported_opcodes_timeout *)
389 	    &buf[sizeof(*one) + cdb_len];
390 
391 	rec_timeout = scsi_4btoul(td->recommended_time);
392 	/*
393 	 * If the recommended timeout is 0, then the device has probably
394 	 * returned a bogus value.
395 	 */
396 	if (rec_timeout == 0)
397 		goto bailout;
398 
399 	/* CAM timeouts are in ms */
400 	rec_timeout *= 1000;
401 
402 	vp->timeout_ms = rec_timeout;
403 	vp->timeout_type = FW_TIMEOUT_DEV_REPORTED;
404 
405 bailout:
406 	return (retval);
407 }
408 
409 #define	SVPD_IBM_FW_DESIGNATION		0x03
410 
411 /*
412  * IBM LTO and TS tape drives have an INQUIRY VPD page 0x3 with the following
413  * format:
414  */
415 struct fw_ibm_tape_fw_designation {
416 	uint8_t	device;
417 	uint8_t page_code;
418 	uint8_t reserved;
419 	uint8_t length;
420 	uint8_t ascii_length;
421 	uint8_t reserved2[3];
422 	uint8_t load_id[4];
423 	uint8_t fw_rev[4];
424 	uint8_t ptf_number[4];
425 	uint8_t patch_number[4];
426 	uint8_t ru_name[8];
427 	uint8_t lib_seq_num[5];
428 };
429 
430 /*
431  * The firmware for IBM tape drives has the following header format.  The
432  * load_id and ru_name in the header file should match what is returned in
433  * VPD page 0x3.
434  */
435 struct fw_ibm_tape_fw_header {
436 	uint8_t unspec[4];
437 	uint8_t length[4];		/* Firmware and header! */
438 	uint8_t load_id[4];
439 	uint8_t fw_rev[4];
440 	uint8_t reserved[8];
441 	uint8_t ru_name[8];
442 };
443 
444 static int
445 fw_validate_ibm(struct cam_device *dev, int retry_count, int timeout, int fd,
446 		char *buf, const char *fw_img_path, int quiet)
447 {
448 	union ccb *ccb;
449 	struct fw_ibm_tape_fw_designation vpd_page;
450 	struct fw_ibm_tape_fw_header *header;
451 	char drive_rev[sizeof(vpd_page.fw_rev) + 1];
452 	char file_rev[sizeof(vpd_page.fw_rev) + 1];
453 	int retval = 1;
454 
455 	ccb = cam_getccb(dev);
456 	if (ccb == NULL) {
457 		warnx("couldn't allocate CCB");
458 		goto bailout;
459 	}
460 
461 	/* cam_getccb cleans up the header, caller has to zero the payload */
462 	bzero(&(&ccb->ccb_h)[1],
463 	      sizeof(struct ccb_scsiio) - sizeof(struct ccb_hdr));
464 
465 	bzero(&vpd_page, sizeof(vpd_page));
466 
467 	scsi_inquiry(&ccb->csio,
468 		     /*retries*/ retry_count,
469 		     /*cbfcnp*/ NULL,
470 		     /* tag_action */ MSG_SIMPLE_Q_TAG,
471 		     /* inq_buf */ (u_int8_t *)&vpd_page,
472 		     /* inq_len */ sizeof(vpd_page),
473 		     /* evpd */ 1,
474 		     /* page_code */ SVPD_IBM_FW_DESIGNATION,
475 		     /* sense_len */ SSD_FULL_SIZE,
476 		     /* timeout */ timeout ? timeout : 5000);
477 
478 	/* Disable freezing the device queue */
479 	ccb->ccb_h.flags |= CAM_DEV_QFRZDIS;
480 
481 	if (retry_count != 0)
482 		ccb->ccb_h.flags |= CAM_PASS_ERR_RECOVER;
483 
484 	if (cam_send_ccb(dev, ccb) < 0) {
485 		warn("error getting firmware designation page");
486 
487 		cam_error_print(dev, ccb, CAM_ESF_ALL,
488 				CAM_EPF_ALL, stderr);
489 
490 		cam_freeccb(ccb);
491 		goto bailout;
492 	}
493 
494 	if ((ccb->ccb_h.status & CAM_STATUS_MASK) != CAM_REQ_CMP) {
495 		cam_error_print(dev, ccb, CAM_ESF_ALL,
496 				CAM_EPF_ALL, stderr);
497 		goto bailout;
498 	}
499 
500 	/*
501 	 * Read the firmware header only.
502 	 */
503 	if (read(fd, buf, sizeof(*header)) != sizeof(*header)) {
504 		warn("unable to read %zu bytes from %s", sizeof(*header),
505 		     fw_img_path);
506 		goto bailout;
507 	}
508 
509 	/* Rewind the file back to 0 for the full file read. */
510 	if (lseek(fd, 0, SEEK_SET) == -1) {
511 		warn("Unable to lseek");
512 		goto bailout;
513 	}
514 
515 	header = (struct fw_ibm_tape_fw_header *)buf;
516 
517 	bzero(drive_rev, sizeof(drive_rev));
518 	bcopy(vpd_page.fw_rev, drive_rev, sizeof(vpd_page.fw_rev));
519 	bzero(file_rev, sizeof(file_rev));
520 	bcopy(header->fw_rev, file_rev, sizeof(header->fw_rev));
521 
522 	if (quiet == 0) {
523 		fprintf(stdout, "Current Drive Firmware version: %s\n",
524 			drive_rev);
525 		fprintf(stdout, "Firmware File version: %s\n", file_rev);
526 	}
527 
528 	/*
529 	 * For IBM tape drives the load ID and RU name reported by the
530 	 * drive should match what is in the firmware file.
531 	 */
532 	if (bcmp(vpd_page.load_id, header->load_id,
533 		 MIN(sizeof(vpd_page.load_id), sizeof(header->load_id))) != 0) {
534 		warnx("Drive Firmware load ID 0x%x does not match firmware "
535 		      "file load ID 0x%x", scsi_4btoul(vpd_page.load_id),
536 		      scsi_4btoul(header->load_id));
537 		goto bailout;
538 	}
539 
540 	if (bcmp(vpd_page.ru_name, header->ru_name,
541 		 MIN(sizeof(vpd_page.ru_name), sizeof(header->ru_name))) != 0) {
542 		warnx("Drive Firmware RU name 0x%jx does not match firmware "
543 		      "file RU name 0x%jx",
544 		      (uintmax_t)scsi_8btou64(vpd_page.ru_name),
545 		      (uintmax_t)scsi_8btou64(header->ru_name));
546 		goto bailout;
547 	}
548 	if (quiet == 0)
549 		fprintf(stdout, "Firmware file is valid for this drive.\n");
550 	retval = 0;
551 bailout:
552 	cam_freeccb(ccb);
553 
554 	return (retval);
555 }
556 
557 /*
558  * Allocate a buffer and read fw image file into it
559  * from given path. Number of bytes read is stored
560  * in num_bytes.
561  */
562 static char *
563 fw_read_img(struct cam_device *dev, int retry_count, int timeout, int quiet,
564 	    const char *fw_img_path, struct fw_vendor *vp, int *num_bytes)
565 {
566 	int fd;
567 	struct stat stbuf;
568 	char *buf;
569 	off_t img_size;
570 	int skip_bytes = 0;
571 
572 	if ((fd = open(fw_img_path, O_RDONLY)) < 0) {
573 		warn("Could not open image file %s", fw_img_path);
574 		return (NULL);
575 	}
576 	if (fstat(fd, &stbuf) < 0) {
577 		warn("Could not stat image file %s", fw_img_path);
578 		goto bailout1;
579 	}
580 	if ((img_size = stbuf.st_size) == 0) {
581 		warnx("Zero length image file %s", fw_img_path);
582 		goto bailout1;
583 	}
584 	if ((buf = malloc(img_size)) == NULL) {
585 		warnx("Could not allocate buffer to read image file %s",
586 		    fw_img_path);
587 		goto bailout1;
588 	}
589 	/* Skip headers if applicable. */
590 	switch (vp->type) {
591 	case VENDOR_SEAGATE:
592 		if (read(fd, buf, 16) != 16) {
593 			warn("Could not read image file %s", fw_img_path);
594 			goto bailout;
595 		}
596 		if (lseek(fd, 0, SEEK_SET) == -1) {
597 			warn("Unable to lseek");
598 			goto bailout;
599 		}
600 		if ((strncmp(buf, "SEAGATE,SEAGATE ", 16) == 0) ||
601 		    (img_size % 512 == 80))
602 			skip_bytes = 80;
603 		break;
604 	case VENDOR_QUALSTAR:
605 		skip_bytes = img_size % 1030;
606 		break;
607 	case VENDOR_IBM: {
608 		if (vp->dev_type != T_SEQUENTIAL)
609 			break;
610 		if (fw_validate_ibm(dev, retry_count, timeout, fd, buf,
611 				    fw_img_path, quiet) != 0)
612 			goto bailout;
613 		break;
614 	}
615 	default:
616 		break;
617 	}
618 	if (skip_bytes != 0) {
619 		fprintf(stdout, "Skipping %d byte header.\n", skip_bytes);
620 		if (lseek(fd, skip_bytes, SEEK_SET) == -1) {
621 			warn("Could not lseek");
622 			goto bailout;
623 		}
624 		img_size -= skip_bytes;
625 	}
626 	/* Read image into a buffer. */
627 	if (read(fd, buf, img_size) != img_size) {
628 		warn("Could not read image file %s", fw_img_path);
629 		goto bailout;
630 	}
631 	*num_bytes = img_size;
632 	close(fd);
633 	return (buf);
634 bailout:
635 	free(buf);
636 bailout1:
637 	close(fd);
638 	*num_bytes = 0;
639 	return (NULL);
640 }
641 
642 /*
643  * Returns 0 for "success", where success means that the device has met the
644  * requirement in the vendor structure for being ready or not ready when
645  * firmware is downloaded.
646  *
647  * Returns 1 for a failure to be ready to accept a firmware download.
648  * (e.g., a drive needs to be ready, but returns not ready)
649  *
650  * Returns -1 for any other failure.
651  */
652 static int
653 fw_check_device_ready(struct cam_device *dev, camcontrol_devtype devtype,
654 		      struct fw_vendor *vp, int printerrors, int timeout)
655 {
656 	union ccb *ccb;
657 	int retval = 0;
658 	int16_t *ptr = NULL;
659 	size_t dxfer_len = 0;
660 
661 	if ((ccb = cam_getccb(dev)) == NULL) {
662 		warnx("Could not allocate CCB");
663 		retval = -1;
664 		goto bailout;
665 	}
666 
667 	bzero(&(&ccb->ccb_h)[1],
668 	      sizeof(union ccb) - sizeof(struct ccb_hdr));
669 
670 	if (devtype != CC_DT_SCSI) {
671 		dxfer_len = sizeof(struct ata_params);
672 
673 		ptr = (uint16_t *)malloc(dxfer_len);
674 		if (ptr == NULL) {
675 			warnx("can't malloc memory for identify");
676 			retval = -1;
677 			goto bailout;
678 		}
679 		bzero(ptr, dxfer_len);
680 	}
681 
682 	switch (devtype) {
683 	case CC_DT_SCSI:
684 		scsi_test_unit_ready(&ccb->csio,
685 				     /*retries*/ 0,
686 				     /*cbfcnp*/ NULL,
687 				     /*tag_action*/ MSG_SIMPLE_Q_TAG,
688 		    		     /*sense_len*/ SSD_FULL_SIZE,
689 				     /*timeout*/ 5000);
690 		break;
691 	case CC_DT_ATA_BEHIND_SCSI:
692 	case CC_DT_ATA: {
693 		build_ata_cmd(ccb,
694 			     /*retries*/ 1,
695 			     /*flags*/ CAM_DIR_IN,
696 			     /*tag_action*/ MSG_SIMPLE_Q_TAG,
697 			     /*protocol*/ AP_PROTO_PIO_IN,
698 			     /*ata_flags*/ AP_FLAG_BYT_BLOK_BYTES |
699 					   AP_FLAG_TLEN_SECT_CNT |
700 					   AP_FLAG_TDIR_FROM_DEV,
701 			     /*features*/ 0,
702 			     /*sector_count*/ (uint8_t) dxfer_len,
703 			     /*lba*/ 0,
704 			     /*command*/ ATA_ATA_IDENTIFY,
705 			     /*data_ptr*/ (uint8_t *)ptr,
706 			     /*dxfer_len*/ dxfer_len,
707 			     /*sense_len*/ SSD_FULL_SIZE,
708 			     /*timeout*/ timeout ? timeout : 30 * 1000,
709 			     /*is48bit*/ 0,
710 			     /*devtype*/ devtype);
711 		break;
712 	}
713 	default:
714 		warnx("Unknown disk type %d", devtype);
715 		retval = -1;
716 		goto bailout;
717 		break; /*NOTREACHED*/
718 	}
719 
720 	ccb->ccb_h.flags |= CAM_DEV_QFRZDIS;
721 
722 	retval = cam_send_ccb(dev, ccb);
723 	if (retval != 0) {
724 		warn("error sending %s CCB", (devtype == CC_DT_SCSI) ?
725 		     "Test Unit Ready" : "Identify");
726 		retval = -1;
727 		goto bailout;
728 	}
729 
730 	if (((ccb->ccb_h.status & CAM_STATUS_MASK) != CAM_REQ_CMP)
731 	 && (vp->tur_status == FW_TUR_READY)) {
732 		warnx("Device is not ready");
733 		if (printerrors)
734 			cam_error_print(dev, ccb, CAM_ESF_ALL,
735 			    CAM_EPF_ALL, stderr);
736 		retval = 1;
737 		goto bailout;
738 	} else if (((ccb->ccb_h.status & CAM_STATUS_MASK) == CAM_REQ_CMP)
739 		&& (vp->tur_status == FW_TUR_NOT_READY)) {
740 		warnx("Device cannot have media loaded when firmware is "
741 		    "downloaded");
742 		retval = 1;
743 		goto bailout;
744 	}
745 bailout:
746 	if (ccb != NULL)
747 		cam_freeccb(ccb);
748 
749 	return (retval);
750 }
751 
752 /*
753  * Download firmware stored in buf to cam_dev. If simulation mode
754  * is enabled, only show what packet sizes would be sent to the
755  * device but do not sent any actual packets
756  */
757 static int
758 fw_download_img(struct cam_device *cam_dev, struct fw_vendor *vp,
759     char *buf, int img_size, int sim_mode, int printerrors, int quiet,
760     int retry_count, int timeout, const char *imgname,
761     camcontrol_devtype devtype)
762 {
763 	struct scsi_write_buffer cdb;
764 	progress_t progress;
765 	int size = 0;
766 	union ccb *ccb = NULL;
767 	int pkt_count = 0;
768 	int max_pkt_size;
769 	u_int32_t pkt_size = 0;
770 	char *pkt_ptr = buf;
771 	u_int32_t offset;
772 	int last_pkt = 0;
773 	int retval = 0;
774 
775 	/*
776 	 * Check to see whether the device is ready to accept a firmware
777 	 * download.
778 	 */
779 	retval = fw_check_device_ready(cam_dev, devtype, vp, printerrors,
780 				       timeout);
781 	if (retval != 0)
782 		goto bailout;
783 
784 	if ((ccb = cam_getccb(cam_dev)) == NULL) {
785 		warnx("Could not allocate CCB");
786 		retval = 1;
787 		goto bailout;
788 	}
789 
790 	bzero(&(&ccb->ccb_h)[1],
791 	      sizeof(union ccb) - sizeof(struct ccb_hdr));
792 
793 	max_pkt_size = vp->max_pkt_size;
794 	if (max_pkt_size == 0)
795 		max_pkt_size = UNKNOWN_MAX_PKT_SIZE;
796 
797 	pkt_size = max_pkt_size;
798 	progress_init(&progress, imgname, size = img_size);
799 	/* Download single fw packets. */
800 	do {
801 		if (img_size <= max_pkt_size) {
802 			last_pkt = 1;
803 			pkt_size = img_size;
804 		}
805 		progress_update(&progress, size - img_size);
806 		if (((sim_mode == 0) && (quiet == 0))
807 		 || ((sim_mode != 0) && (printerrors == 0)))
808 			progress_draw(&progress);
809 		bzero(&cdb, sizeof(cdb));
810 		switch (devtype) {
811 		case CC_DT_SCSI:
812 			cdb.opcode  = WRITE_BUFFER;
813 			cdb.control = 0;
814 			/* Parameter list length. */
815 			scsi_ulto3b(pkt_size, &cdb.length[0]);
816 			offset = vp->inc_cdb_offset ? (pkt_ptr - buf) : 0;
817 			scsi_ulto3b(offset, &cdb.offset[0]);
818 			cdb.byte2 = last_pkt ? vp->cdb_byte2_last :
819 					       vp->cdb_byte2;
820 			cdb.buffer_id = vp->inc_cdb_buffer_id ? pkt_count : 0;
821 			/* Zero out payload of ccb union after ccb header. */
822 			bzero(&(&ccb->ccb_h)[1],
823 			    sizeof(struct ccb_scsiio) - sizeof(struct ccb_hdr));
824 			/*
825 			 * Copy previously constructed cdb into ccb_scsiio
826 			 * struct.
827 			 */
828 			bcopy(&cdb, &ccb->csio.cdb_io.cdb_bytes[0],
829 			    sizeof(struct scsi_write_buffer));
830 			/* Fill rest of ccb_scsiio struct. */
831 			cam_fill_csio(&ccb->csio,		/* ccb_scsiio*/
832 			    retry_count,			/* retries*/
833 			    NULL,				/* cbfcnp*/
834 			    CAM_DIR_OUT | CAM_DEV_QFRZDIS,	/* flags*/
835 			    CAM_TAG_ACTION_NONE,		/* tag_action*/
836 			    (u_char *)pkt_ptr,			/* data_ptr*/
837 			    pkt_size,				/* dxfer_len*/
838 			    SSD_FULL_SIZE,			/* sense_len*/
839 			    sizeof(struct scsi_write_buffer),	/* cdb_len*/
840 			    timeout ? timeout : WB_TIMEOUT);	/* timeout*/
841 			break;
842 		case CC_DT_ATA:
843 		case CC_DT_ATA_BEHIND_SCSI: {
844 			uint32_t	off;
845 
846 			off = (uint32_t)(pkt_ptr - buf);
847 
848 			build_ata_cmd(ccb,
849 			    /*retry_count*/ retry_count,
850 			    /*flags*/ CAM_DIR_OUT | CAM_DEV_QFRZDIS,
851 			    /*tag_action*/ CAM_TAG_ACTION_NONE,
852 			    /*protocol*/ AP_PROTO_PIO_OUT,
853 			    /*ata_flags*/ AP_FLAG_BYT_BLOK_BYTES |
854 					  AP_FLAG_TLEN_SECT_CNT |
855 					  AP_FLAG_TDIR_TO_DEV,
856 			    /*features*/ USE_OFFSETS_FEATURE,
857 			    /*sector_count*/ ATA_MAKE_SECTORS(pkt_size),
858 			    /*lba*/ ATA_MAKE_LBA(off, pkt_size),
859 			    /*command*/ ATA_DOWNLOAD_MICROCODE,
860 			    /*data_ptr*/ (uint8_t *)pkt_ptr,
861 			    /*dxfer_len*/ pkt_size,
862 			    /*sense_len*/ SSD_FULL_SIZE,
863 			    /*timeout*/ timeout ? timeout : WB_TIMEOUT,
864 			    /*is48bit*/ 0,
865 			    /*devtype*/ devtype);
866 			break;
867 		}
868 		default:
869 			warnx("Unknown device type %d", devtype);
870 			retval = 1;
871 			goto bailout;
872 			break; /*NOTREACHED*/
873 		}
874 		if (!sim_mode) {
875 			/* Execute the command. */
876 			if (cam_send_ccb(cam_dev, ccb) < 0 ||
877 			    (ccb->ccb_h.status & CAM_STATUS_MASK) !=
878 			    CAM_REQ_CMP) {
879 				warnx("Error writing image to device");
880 				if (printerrors)
881 					cam_error_print(cam_dev, ccb,
882 					    CAM_ESF_ALL, CAM_EPF_ALL, stderr);
883 				retval = 1;
884 				goto bailout;
885 			}
886 		} else if (printerrors) {
887 			cam_error_print(cam_dev, ccb, CAM_ESF_COMMAND, 0,
888 			    stdout);
889 		}
890 
891 		/* Prepare next round. */
892 		pkt_count++;
893 		pkt_ptr += pkt_size;
894 		img_size -= pkt_size;
895 	} while(!last_pkt);
896 bailout:
897 	if (quiet == 0)
898 		progress_complete(&progress, size - img_size);
899 	if (ccb != NULL)
900 		cam_freeccb(ccb);
901 	return (retval);
902 }
903 
904 int
905 fwdownload(struct cam_device *device, int argc, char **argv,
906     char *combinedopt, int printerrors, int retry_count, int timeout)
907 {
908 	struct fw_vendor *vp;
909 	char *fw_img_path = NULL;
910 	struct ata_params *ident_buf = NULL;
911 	camcontrol_devtype devtype;
912 	char *buf = NULL;
913 	int img_size;
914 	int c;
915 	int sim_mode = 0;
916 	int confirmed = 0;
917 	int quiet = 0;
918 	int retval = 0;
919 
920 	while ((c = getopt(argc, argv, combinedopt)) != -1) {
921 		switch (c) {
922 		case 'f':
923 			fw_img_path = optarg;
924 			break;
925 		case 'q':
926 			quiet = 1;
927 			break;
928 		case 's':
929 			sim_mode = 1;
930 			break;
931 		case 'y':
932 			confirmed = 1;
933 			break;
934 		default:
935 			break;
936 		}
937 	}
938 
939 	if (fw_img_path == NULL)
940 		errx(1, "you must specify a firmware image file using -f "
941 		     "option");
942 
943 	retval = get_device_type(device, retry_count, timeout, printerrors,
944 				 &devtype);
945 	if (retval != 0)
946 		errx(1, "Unable to determine device type");
947 
948 	if ((devtype == CC_DT_ATA)
949 	 || (devtype == CC_DT_ATA_BEHIND_SCSI)) {
950 		union ccb *ccb;
951 
952 		ccb = cam_getccb(device);
953 		if (ccb == NULL) {
954 			warnx("couldn't allocate CCB");
955 			retval = 1;
956 			goto bailout;
957 		}
958 
959 		if (ata_do_identify(device, retry_count, timeout, ccb,
960 		    		    &ident_buf) != 0) {
961 			cam_freeccb(ccb);
962 			retval = 1;
963 			goto bailout;
964 		}
965 	} else if (devtype != CC_DT_SCSI)
966 		errx(1, "Unsupported device type %d", devtype);
967 
968 	vp = fw_get_vendor(device, ident_buf);
969 	/*
970 	 * Bail out if we have an unknown vendor and this isn't an ATA
971 	 * disk.  For a SCSI disk, we have no chance of working properly
972 	 * with the default values in the VENDOR_UNKNOWN case.  For an ATA
973 	 * disk connected via an ATA transport, we may work for drives that
974 	 * support the ATA_DOWNLOAD_MICROCODE command.
975 	 */
976 	if (((vp == NULL)
977 	  || (vp->type == VENDOR_UNKNOWN))
978 	 && (devtype == CC_DT_SCSI))
979 		errx(1, "Unsupported device");
980 
981 	retval = fw_get_timeout(device, vp, retry_count, timeout);
982 	if (retval != 0) {
983 		warnx("Unable to get a firmware download timeout value");
984 		goto bailout;
985 	}
986 
987 	buf = fw_read_img(device, retry_count, timeout, quiet, fw_img_path,
988 	    vp, &img_size);
989 	if (buf == NULL) {
990 		retval = 1;
991 		goto bailout;
992 	}
993 
994 	if (!confirmed) {
995 		fprintf(stdout, "You are about to download firmware image (%s)"
996 		    " into the following device:\n",
997 		    fw_img_path);
998 		if (devtype == CC_DT_SCSI) {
999 			if (scsidoinquiry(device, argc, argv, combinedopt, 0,
1000 					  5000) != 0) {
1001 				warnx("Error sending inquiry");
1002 				retval = 1;
1003 				goto bailout;
1004 			}
1005 		} else {
1006 			printf("%s%d: ", device->device_name,
1007 			    device->dev_unit_num);
1008 			ata_print_ident(ident_buf);
1009 			camxferrate(device);
1010 			free(ident_buf);
1011 		}
1012 		fprintf(stdout, "Using a timeout of %u ms, which is %s.\n",
1013 			vp->timeout_ms,
1014 			fw_timeout_desc_table[vp->timeout_type].timeout_desc);
1015 		fprintf(stdout, "\nIt may damage your drive. ");
1016 		if (!get_confirmation()) {
1017 			retval = 1;
1018 			goto bailout;
1019 		}
1020 	}
1021 	if ((sim_mode != 0) && (quiet == 0))
1022 		fprintf(stdout, "Running in simulation mode\n");
1023 
1024 	if (fw_download_img(device, vp, buf, img_size, sim_mode, printerrors,
1025 	    quiet, retry_count, vp->timeout_ms, fw_img_path, devtype) != 0) {
1026 		fprintf(stderr, "Firmware download failed\n");
1027 		retval = 1;
1028 		goto bailout;
1029 	} else if (quiet == 0)
1030 		fprintf(stdout, "Firmware download successful\n");
1031 
1032 bailout:
1033 	free(buf);
1034 	return (retval);
1035 }
1036 
1037